cve recordexploit reported

CVE-2022-25497

CVSS—

Severitynone

Weakness—

EPSS3.6%89.2th percentile

Exploited1 KEV source

patch window

Called exploited 1647 days after disclosure.

Measured from the CVE publication date to the earliest of 1 KEV catalogue that list it.

The life of this vulnerability

CVE reservedFeb 21, 2022
CVE publishedMar 15, 202222d
First KEV listingSep 17, 20264.5y
Last sightingSep 17, 2026same day

Gaps are compressed to equal steps. The elapsed time is printed under each.

Which catalogues call it exploited

CISA KEVUS federaldoes not list it
EUVDENISA, European Uniondoes not list it
VulnCheck KEVcommercial researchlisted Sep 17, 2026
CIRCLaggregator, mirrors the abovelisted Sep 17, 2026, not counted

Sources1 of 3

Listings differ by—

Strongest claimconfirmed

This rests on a single catalogue. No second catalogue corroborates the claim that it is being exploited. CIRCL is an aggregator and is not counted.

Public exploitation evidence

reported exploitationSep 17, 2026previdian.com/CVE-2022-25497

1 public report collected from VulnCheck and CIRCL, first on Sep 17, 2026. Each links to its original source. We have not verified them.

Description

References

← Back to the CVE Tracker

Our coverage of CVE-2022-25497

CVE-2022-25497Oct 2, 2026high

CuppaCMS Flaw Listed in VulnCheck KEV, Not CISA KEV

CVE-2022-25497, a vulnerability in CuppaCMS, was added to the VulnCheck Known Exploited Vulnerabilities catalogue on September 17, 2026, but remains absent from the US federal CISA KEV catalogue and the European Union's EUVD catalogue.