# CVEs published 2025-02-23 30 CVEs were published on February 23, 2025: 0 critical, 3 high. Days are UTC. - [CVE-2025-1598](https://cve.now/CVE-2025-1598.md): SourceCodester Best Church Management Software asset\_crud.php unrestricted upload (CVSS 5.3, SourceCodester Best Church Management Software) - [CVE-2025-1597](https://cve.now/CVE-2025-1597.md): SourceCodester Best Church Management Software redirect.php cross site scripting (CVSS 5.1, SourceCodester Best Church Management Software) - [CVE-2025-1596](https://cve.now/CVE-2025-1596.md): SourceCodester Best Church Management Software fpassword.php sql injection (CVSS 6.9, SourceCodester Best Church Management Software) - [CVE-2025-22635](https://cve.now/CVE-2025-22635.md): WordPress Eventer - WordPress Event & Booking Manager Plugin plugin \< 3.9.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, imithemes Eventer) - [CVE-2025-22633](https://cve.now/CVE-2025-22633.md): WordPress Give – Divi Donation Modules plugin \<= 2.0.0 - Sensitive Data Exposure vulnerability (CVSS 5.8, StellarWP Give – Divi Donation Modules) - [CVE-2025-22632](https://cve.now/CVE-2025-22632.md): WordPress WooCommerce Pricing – Product Pricing plugin \<= 1.0.9 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, totalsoft WooCommerce Pricing – Product Pricing) - [CVE-2025-22631](https://cve.now/CVE-2025-22631.md): WordPress Marketing Automation Plugin \<= 1.2.6.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, vbout Marketing Automation) - [CVE-2025-1595](https://cve.now/CVE-2025-1595.md): Anhui Xufan Information Technology EasyCVR getbaseconfig information disclosure (CVSS 6.9, Anhui Xufan Information Technology EasyCVR) - [CVE-2025-1594](https://cve.now/CVE-2025-1594.md): FFmpeg AAC Encoder aacenc\_tns.c ff\_aac\_search\_for\_tns stack-based overflow (CVSS 5.3, FFmpeg) - [CVE-2025-1593](https://cve.now/CVE-2025-1593.md): SourceCodester Best Employee Management System Profile Picture unrestricted upload (CVSS 5.1, SourceCodester Best Employee Management System) - [CVE-2025-1592](https://cve.now/CVE-2025-1592.md): SourceCodester Best Employee Management System Add Role Page Role.php cross site scripting (CVSS 4.8, SourceCodester Best Employee Management System) - [CVE-2025-1591](https://cve.now/CVE-2025-1591.md): SourceCodester Employee Management System Department Page department.php cross site scripting (CVSS 4.8, SourceCodester Employee Management System) - [CVE-2025-1590](https://cve.now/CVE-2025-1590.md): SourceCodester E-Learning System List of Lessons Page index.php unrestricted upload (CVSS 5.1, SourceCodester E-Learning System) - [CVE-2025-1589](https://cve.now/CVE-2025-1589.md): SourceCodester E-Learning System User Registration register.php cross site scripting (CVSS 5.3, SourceCodester E-Learning System) - [CVE-2025-1588](https://cve.now/CVE-2025-1588.md): PHPGurukul Online Nurse Hiring System manage-nurse.php path traversal (CVSS 6.9, PHPGurukul Online Nurse Hiring System) - [CVE-2025-1467](https://cve.now/CVE-2025-1467.md): Versions of the package tarteaucitronjs before 1.17.0 are vulnerable to Cross-site Scripting (XSS) via the getElemWidth() and getElemHeight( (CVSS 5.1, tarteaucitronjs) - [CVE-2025-1587](https://cve.now/CVE-2025-1587.md): SourceCodester Telecom Billing Management System Add New Record main.cpp addrecords buffer overflow (CVSS 4.8, SourceCodester Telecom Billing Management System) - [CVE-2025-1586](https://cve.now/CVE-2025-1586.md): code-projects Blood Bank System A-.php cross site scripting (CVSS 5.1, code-projects Blood Bank System) - [CVE-2025-1585](https://cve.now/CVE-2025-1585.md): otale header.html OptionsService cross site scripting (CVSS 4.8, otale tale) - [CVE-2025-1584](https://cve.now/CVE-2025-1584.md): opensolon Solon StaticMappings.java path traversal (CVSS 5.3, opensolon Solon · org.noear:solon-web-staticfiles) - [CVE-2025-1583](https://cve.now/CVE-2025-1583.md): PHPGurukul Online Nurse Hiring System search-report-details.php sql injection (CVSS 5.3, PHPGurukul Online Nurse Hiring System) - [CVE-2025-1582](https://cve.now/CVE-2025-1582.md): PHPGurukul Online Nurse Hiring System all-request.php sql injection (CVSS 5.3, PHPGurukul Online Nurse Hiring System) - [CVE-2025-1581](https://cve.now/CVE-2025-1581.md): PHPGurukul Online Nurse Hiring System book-nurse.php sql injection (CVSS 5.3, PHPGurukul Online Nurse Hiring System) - [CVE-2025-1580](https://cve.now/CVE-2025-1580.md): PHPGurukul Nipah Virus Testing Management System search-report-result.php sql injection (CVSS 5.3, PHPGurukul Nipah Virus Testing Management System) - [CVE-2025-1579](https://cve.now/CVE-2025-1579.md): code-projects Blood Bank System user.php cross site scripting (CVSS 4.8, code-projects Blood Bank System) - [CVE-2025-1578](https://cve.now/CVE-2025-1578.md): PHPGurukul/Campcodes Online Shopping Portal search-result.php sql injection (CVSS 5.3, PHPGurukul Online Shopping Portal · Campcodes Online Shoppi…) - [CVE-2025-1577](https://cve.now/CVE-2025-1577.md): code-projects Blood Bank System prostatus.php cross site scripting (CVSS 5.1, code-projects Blood Bank System) - [CVE-2024-13728](https://cve.now/CVE-2024-13728.md): Accept Donations with PayPal & Stripe \<= 1.4.4 - Reflected Cross-Site Scripting (CVSS 6.1, scottpaterson Accept Donations with PayPal & Stripe) - [CVE-2025-1576](https://cve.now/CVE-2025-1576.md): code-projects Real Estate Property Management System ajax\_state.php sql injection (CVSS 5.3, code-projects Real Estate Property Management System) - [CVE-2025-1575](https://cve.now/CVE-2025-1575.md): Harpia DiagSystem atualatendimento\_jpeg.php resource injection (CVSS 5.3, Harpia DiagSystem) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-02-23 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.