# CVEs published 2025-03-23 40 CVEs were published on March 23, 2025: 0 critical, 3 high. Days are UTC. - [CVE-2025-2673](https://cve.now/CVE-2025-2673.md): code-projects Payroll Management System home\_employee.php cross site scripting (CVSS 5.1, code-projects Payroll Management System) - [CVE-2025-2672](https://cve.now/CVE-2025-2672.md): code-projects Payroll Management System add\_deductions.php sql injection (CVSS 5.3, code-projects Payroll Management System) - [CVE-2018-25109](https://cve.now/CVE-2018-25109.md): Nintendo Animal Crossing Letter Trigram ac-exploit-gc memory corruption (CVSS 5.4, Nintendo Animal Crossing · Nintendo Doubutsu no Mori+ +1) - [CVE-2025-2671](https://cve.now/CVE-2025-2671.md): Yue Lao Blind Box 月老盲盒 Upload.php base64image unrestricted upload (CVSS 5.3, Yue Lao Blind Box 月老盲盒) - [CVE-2025-2665](https://cve.now/CVE-2025-2665.md): PHPGurukul Online Security Guards Hiring System bwdates-reports-details.php sql injection (CVSS 6.9, PHPGurukul Online Security Guards Hiring System) - [CVE-2025-2664](https://cve.now/CVE-2025-2664.md): CodeZips Hospital Management System suadpeted.php sql injection (CVSS 5.1, CodeZips Hospital Management System) - [CVE-2025-2663](https://cve.now/CVE-2025-2663.md): PHPGurukul Bank Locker Management System search-locker-details.php sql injection (CVSS 6.9, PHPGurukul Bank Locker Management System) - [CVE-2025-2662](https://cve.now/CVE-2025-2662.md): Project Worlds Online Time Table Generator studentdashboard.php sql injection (CVSS 5.3, Project Worlds Online Time Table Generator) - [CVE-2025-2661](https://cve.now/CVE-2025-2661.md): Project Worlds Online Time Table Generator index.php sql injection (CVSS 6.9, Project Worlds Online Time Table Generator) - [CVE-2025-2660](https://cve.now/CVE-2025-2660.md): Project Worlds Online Time Table Generator index.php sql injection (CVSS 6.9, Project Worlds Online Time Table Generator) - [CVE-2025-2659](https://cve.now/CVE-2025-2659.md): Project Worlds Online Time Table Generator index.php sql injection (CVSS 6.9, Project Worlds Online Time Table Generator) - [CVE-2025-2658](https://cve.now/CVE-2025-2658.md): PHPGurukul Online Security Guards Hiring System search-request.php sql injection (CVSS 6.9, PHPGurukul Online Security Guards Hiring System) - [CVE-2025-2657](https://cve.now/CVE-2025-2657.md): projectworlds Apartment Visitors Management System front.php sql injection (CVSS 6.9, projectworlds Apartment Visitors Management System) - [CVE-2025-2656](https://cve.now/CVE-2025-2656.md): PHPGurukul Zoo Management System login.php sql injection (CVSS 6.9, PHPGurukul Zoo Management System) - [CVE-2025-2655](https://cve.now/CVE-2025-2655.md): SourceCodester AC Repair and Services System Users.php delete\_users sql injection (CVSS 6.9, SourceCodester AC Repair and Services System) - [CVE-2025-29795](https://cve.now/CVE-2025-29795.md): Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Edge Update Setup) - [CVE-2025-29806](https://cve.now/CVE-2025-29806.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 6.5, Microsoft Edge) - [CVE-2025-2654](https://cve.now/CVE-2025-2654.md): SourceCodester AC Repair and Services System manage\_service.php sql injection (CVSS 6.9, SourceCodester AC Repair and Services System) - [CVE-2025-2653](https://cve.now/CVE-2025-2653.md): FoxCMS improper authorization (CVSS 5.3, FoxCMS) - [CVE-2025-2652](https://cve.now/CVE-2025-2652.md): SourceCodester Employee and Visitor Gate Pass Logging System exposure of information through directory listing (CVSS 6.9, SourceCodester Employee and Visitor Gate Pass Logging System) - [CVE-2025-2651](https://cve.now/CVE-2025-2651.md): SourceCodester Online Eyewear Shop admin exposure of information through directory listing (CVSS 6.9, SourceCodester Online Eyewear Shop) - [CVE-2025-2691](https://cve.now/CVE-2025-2691.md): Versions of the package nossrf before 1.0.4 are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide a hostname th (CVSS 8.8, nossrf) - [CVE-2025-27553](https://cve.now/CVE-2025-27553.md): Apache Commons VFS: Possible path traversal issue when using NameScope.DESCENDENT (CVSS 7.5, Apache Software Foundation Apache Commons VFS · org.apache.…) - [CVE-2025-30474](https://cve.now/CVE-2025-30474.md): Apache Commons VFS: Failing to find an FTP file can reveal the URI's password in an error message (CVSS 5.0, Apache Software Foundation Apache Commons VFS · org.apache.…) - [CVE-2025-2650](https://cve.now/CVE-2025-2650.md): PHPGurukul Medical Card Generation System download-medical-cards.php cross site scripting (CVSS 5.1, PHPGurukul Medical Card Generation System) - [CVE-2025-2649](https://cve.now/CVE-2025-2649.md): PHPGurukul Doctor Appointment Management System check-appointment.php sql injection (CVSS 6.9, PHPGurukul Doctor Appointment Management System) - [CVE-2025-2648](https://cve.now/CVE-2025-2648.md): PHPGurukul Art Gallery Management System view-enquiry-detail.php sql injection (CVSS 6.9, PHPGurukul Art Gallery Management System) - [CVE-2025-2647](https://cve.now/CVE-2025-2647.md): PHPGurukul Art Gallery Management System search.php sql injection (CVSS 6.9, PHPGurukul Art Gallery Management System) - [CVE-2025-2646](https://cve.now/CVE-2025-2646.md): PHPGurukul Art Gallery Management System admin-profile.php sql injection (CVSS 6.9, PHPGurukul Art Gallery Management System) - [CVE-2025-2645](https://cve.now/CVE-2025-2645.md): PHPGurukul Art Gallery Management System product.php cross site scripting (CVSS 5.1, PHPGurukul Art Gallery Management System) - [CVE-2025-2644](https://cve.now/CVE-2025-2644.md): PHPGurukul Art Gallery Management System add-art-product.php sql injection (CVSS 6.9, PHPGurukul Art Gallery Management System) - [CVE-2025-2643](https://cve.now/CVE-2025-2643.md): PHPGurukul Art Gallery Management System edit-art-type-detail.php sql injection (CVSS 6.9, PHPGurukul Art Gallery Management System) - [CVE-2025-2642](https://cve.now/CVE-2025-2642.md): PHPGurukul Art Gallery Management System edit-art-product-detail.php sql injection (CVSS 6.9, PHPGurukul Art Gallery Management System) - [CVE-2025-1446](https://cve.now/CVE-2025-1446.md): Pods \< 3.2.8.2 - Admin+ SQL Injection (CVSS 4.1, Pods) - [CVE-2025-0718](https://cve.now/CVE-2025-0718.md): Nested Pages \< 3.2.13 - Contributor+ Stored XSS (CVSS 4.8, Nested Pages) - [CVE-2025-2641](https://cve.now/CVE-2025-2641.md): PHPGurukul Art Gallery Management System edit-artist-detail.php sql injection (CVSS 6.9, PHPGurukul Art Gallery Management System) - [CVE-2025-2640](https://cve.now/CVE-2025-2640.md): PHPGurukul Doctor Appointment Management System appointment-bwdates-reports-details.php sql injection (CVSS 6.9, PHPGurukul Doctor Appointment Management System) - [CVE-2025-2639](https://cve.now/CVE-2025-2639.md): JIZHICMS Article release.html improper authorization (CVSS 5.3, JIZHICMS) - [CVE-2025-2638](https://cve.now/CVE-2025-2638.md): JIZHICMS Article release.html improper authorization (CVSS 5.3, JIZHICMS) - [CVE-2025-2637](https://cve.now/CVE-2025-2637.md): JIZHICMS Account Profile Page userinfo.html improper authorization (CVSS 5.3, JIZHICMS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2025-03-23 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.