https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-50972.htmlhttps://patchthecve.com/cve/CVE-2025-50972.htmlWed, 17 Jun 2026 09:35:28 +0000CRITICAL 9.8: SQL Injection vulnerability in AbanteCart 1.4.2, allows unauthenticated attackers to execute arbitrary SQL commands via the tmpl_id parameter to index.php. Three techniques have been demonstrated: error-based injection using a crafted FLOOR-based payload, time-based blind injection via SLEEP(), and https://patchthecve.com/cve/CVE-2025-50971.htmlhttps://patchthecve.com/cve/CVE-2025-50971.htmlWed, 17 Jun 2026 09:35:27 +0000HIGH 7.5: Directory traversal vulnerability in AbanteCart version 1.4.2 allows unauthenticated attackers to gain access to sensitive system files via the template parameter to index.php.https://patchthecve.com/cve/CVE-2025-40627.htmlhttps://patchthecve.com/cve/CVE-2025-40627.htmlWed, 17 Jun 2026 09:21:51 +0000MEDIUM 6.1: Reflected Cross-Site Scripting (XSS) vulnerability in AbanteCart v1.4.0, that could allow an attacker to execute JavaScript code in a victim's browser by sending the victim a malicious URL. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actiohttps://patchthecve.com/cve/CVE-2025-40626.htmlhttps://patchthecve.com/cve/CVE-2025-40626.htmlWed, 17 Jun 2026 09:21:51 +0000MEDIUM 6.1: Reflected Cross-Site Scripting (XSS) vulnerability in AbanteCart v1.4.0, that could allow an attacker to execute JavaScript code in a victim's browser by sending the victim a malicious URL. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actiohttps://patchthecve.com/cve/CVE-2024-50802.htmlhttps://patchthecve.com/cve/CVE-2024-50802.htmlWed, 17 Jun 2026 08:05:01 +0000MEDIUM 6.0: A SQL Injection vulnerability was discovered in AbanteCart 1.4.0 in the update() function in public_html/admin/controller/responses/listing_grid/email_templates.php. The vulnerability is exploitable via the id parameter.https://patchthecve.com/cve/CVE-2024-50801.htmlhttps://patchthecve.com/cve/CVE-2024-50801.htmlWed, 17 Jun 2026 08:05:01 +0000MEDIUM 6.0: A SQL Injection vulnerability was discovered in AbanteCart 1.4.0 in the update() function in public_html/admin/controller/responses/listing_grid/collections.php. The vulnerability is exploitable via the id parameter.