# CVEs published 2025-03-22

38 CVEs were published on March 22, 2025: 5 critical, 5 high. Days are UTC.

- [CVE-2025-2628](https://cve.now/CVE-2025-2628.md): PHPGurukul Art Gallery Management System art-enquiry.php sql injection (CVSS 5.3, PHPGurukul Art Gallery Management System)
- [CVE-2025-2627](https://cve.now/CVE-2025-2627.md): PHPGurukul Art Gallery Management System contactus.php sql injection (CVSS 5.3, PHPGurukul Art Gallery Management System)
- [CVE-2025-2626](https://cve.now/CVE-2025-2626.md): SourceCodester Kortex Lite Advocate Office Management System edit\_case.php sql injection (CVSS 5.3, SourceCodester Kortex Lite Advocate Office Management System)
- [CVE-2025-2625](https://cve.now/CVE-2025-2625.md): westboy CicadasCMS page sql injection (CVSS 5.3, westboy CicadasCMS)
- [CVE-2025-2624](https://cve.now/CVE-2025-2624.md): westboy CicadasCMS save sql injection (CVSS 5.3, westboy CicadasCMS)
- [CVE-2025-2623](https://cve.now/CVE-2025-2623.md): westboy CicadasCMS save cross site scripting (CVSS 5.1, westboy CicadasCMS)
- [CVE-2025-2622](https://cve.now/CVE-2025-2622.md): aizuda snail-job Workflow-Task Management Module check-node-expression getRuntime deserialization (CVSS 5.3, aizuda snail-job · com.aizuda:snail-job)
- [CVE-2025-2621](https://cve.now/CVE-2025-2621.md): D-Link DAP-1620 storage check\_dws\_cookie stack-based overflow (CVSS 9.3, D-Link DAP-1620)
- [CVE-2025-2620](https://cve.now/CVE-2025-2620.md): D-Link DAP-1620 Authentication storage mod\_graph\_auth\_uri\_handler stack-based overflow (CVSS 9.3, D-Link DAP-1620)
- [CVE-2025-2619](https://cve.now/CVE-2025-2619.md): D-Link DAP-1620 Cookie storage check\_dws\_cookie stack-based overflow (CVSS 9.3, D-Link DAP-1620)
- [CVE-2025-2618](https://cve.now/CVE-2025-2618.md): D-Link DAP-1620 Path api set\_ws\_action heap-based overflow (CVSS 9.3, D-Link DAP-1620)
- [CVE-2025-2186](https://cve.now/CVE-2025-2186.md): Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit \<= 3.5.1 - Unauthenticated SQL Injection via 'automationId' (CVSS 7.5, amans2k FunnelKit Automations – Email Marketing Automation…)
- [CVE-2025-2617](https://cve.now/CVE-2025-2617.md): yangyouwang 杨有旺 crud 简约后台管理系统 Department Page cross site scripting (CVSS 4.8, yangyouwang 杨有旺 crud 简约后台管理系统)
- [CVE-2025-26796](https://cve.now/CVE-2025-26796.md): Apache Oozie: XSS in Oozie Web Console (CVSS 5.4, Apache Software Foundation Apache Oozie · org.apache.oozie:…)
- [CVE-2025-1973](https://cve.now/CVE-2025-1973.md): Export and Import Users and Customers \<= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download\_file Function (CVSS 4.9, webtoffee Export and Import Users and Customers)
- [CVE-2025-2331](https://cve.now/CVE-2025-2331.md): GiveWP – Donation Plugin and Fundraising Platform \<= 3.22.1 - Authenticated (Subscriber+) Sensitive Information Exposure (CVSS 5.3, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2025-1970](https://cve.now/CVE-2025-1970.md): Export and Import Users and Customers \<= 2.6.2 - Authenticated (Administrator+) Server-Side Request Forgery via validate\_file Function (CVSS 7.6, webtoffee Export and Import Users and Customers)
- [CVE-2025-1971](https://cve.now/CVE-2025-1971.md): Export and Import Users and Customers \<= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form\_data Parameter (CVSS 7.2, webtoffee Export and Import Users and Customers)
- [CVE-2025-1972](https://cve.now/CVE-2025-1972.md): Export and Import Users and Customers \<= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin\_log\_page Function (CVSS 2.7, webtoffee Export and Import Users and Customers)
- [CVE-2025-2577](https://cve.now/CVE-2025-2577.md): Bitspecter Suite \<= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (CVSS 6.4, Bitspecter Suite)
- [CVE-2025-2616](https://cve.now/CVE-2025-2616.md): yangyouwang 杨有旺 crud 简约后台管理系统 Role Management Page cross site scripting (CVSS 4.8, yangyouwang 杨有旺 crud 简约后台管理系统)
- [CVE-2024-13666](https://cve.now/CVE-2024-13666.md): Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder \<= 5.2.12 - IP-Spoofing (CVSS 5.3, techjewel Fluent Forms – Customizable Contact Forms, Survey…)
- [CVE-2024-13768](https://cve.now/CVE-2024-13768.md): CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts \<= 4.2 - Cross-Site Request Forgery to Font Assignment Deletion (CVSS 4.3, ashikcse CITS Support svg, webp Media and TTF,OTF File Uplo…)
- [CVE-2025-2478](https://cve.now/CVE-2025-2478.md): Code Clone \<= 0.9 - Authenticated (Administrator+) SQL Injection via snippetId Parameter (CVSS 4.9, allhart Code Clone)
- [CVE-2024-13856](https://cve.now/CVE-2024-13856.md): Make Builder \<= 1.1.10 - Authenticated (Subscriber+) Server-Side Request Forgery via make\_builder\_ajax\_subscribe Function (CVSS 6.4, thethemefoundry Your Friendly Drag and Drop Page Builder —…)
- [CVE-2025-1311](https://cve.now/CVE-2025-1311.md): WooCommerce Multivendor Marketplace – REST API \<= 1.6.2 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, wclovers WCFM – Multivendor Marketplace REST API for WooCom…)
- [CVE-2025-2482](https://cve.now/CVE-2025-2482.md): Gotcha | Gesture-based Captcha \<= 1.0.0 - Reflected Cross-Site Scripting via menu Parameter (CVSS 6.1, pienaro Gotcha | Gesture-based Captcha)
- [CVE-2025-2303](https://cve.now/CVE-2025-2303.md): Block Logic \<= 1.0.8 - Authenticated (Contributor+) Remote Code Execution (CVSS 8.8, landwire Block Logic – Full Block Display Control)
- [CVE-2025-2484](https://cve.now/CVE-2025-2484.md): Multi Video Box \<= 1.5.2 - Reflected Cross-Site Scripting via video\_id and group\_id Parameters (CVSS 6.1, skustes Multi Video Box)
- [CVE-2025-0807](https://cve.now/CVE-2025-0807.md): CITS Support svg, webp Media and TTF,OTF File Upload, Use Custom Fonts \<= 4.2 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, ashikcse CITS Support svg, webp Media and TTF,OTF File Uplo…)
- [CVE-2025-2477](https://cve.now/CVE-2025-2477.md): CryoKey \<= 2.4 - Reflected Cross-Site Scripting via 'ckemail' Parameter (CVSS 4.7, CryoKey)
- [CVE-2025-2479](https://cve.now/CVE-2025-2479.md): Easy Custom Admin Bar \<= 1.0 - Reflected Cross-Site Scripting via msg Parameter (CVSS 6.1, duogeek Easy Custom Admin Bar)
- [CVE-2025-0724](https://cve.now/CVE-2025-0724.md): ProfileGrid – User Profiles, Groups and Communities \<= 5.9.4.5 - Authenticated (Subscriber+) PHP Object Injection (CVSS 8.8, metagauss ProfileGrid – User Profiles, Groups and Communiti…)
- [CVE-2025-1408](https://cve.now/CVE-2025-1408.md): ProfileGrid – User Profiles, Groups and Communities \<= 5.9.4.4 - Missing Authorinzation to Authenticated (Subscriber+) Join Group Requests Management (CVSS 4.3, metagauss ProfileGrid – User Profiles, Groups and Communiti…)
- [CVE-2024-13739](https://cve.now/CVE-2024-13739.md): Newsletters \<= 4.9.9.7 - Reflected Cross-Site Scripting via To Parameter (CVSS 6.1, contrid Newsletters)
- [CVE-2025-0723](https://cve.now/CVE-2025-0723.md): ProfileGrid – User Profiles, Groups and Communities \<= 5.9.4.7 - Authenticated (Subscriber+) SQL Injection (CVSS 6.5, metagauss ProfileGrid – User Profiles, Groups and Communiti…)
- [CVE-2024-13737](https://cve.now/CVE-2024-13737.md): Motors – Car Dealer, Classifieds & Listing \<= 1.4.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Listing Template Creation (CVSS 4.3, stylemix Motors – Car Dealership & Classified Listings Plug…)
- [CVE-2025-30472](https://cve.now/CVE-2025-30472.md): Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf\_token\_e (CVSS 9.0, Corosync)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-03-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.