https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-40347.htmlhttps://patchthecve.com/cve/CVE-2024-40347.htmlWed, 17 Jun 2026 07:45:48 +0000MEDIUM 6.1: A reflected cross-site scripting (XSS) vulnerability in Hyland Alfresco Platform 23.2.1-r96 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the parameter htmlid.https://patchthecve.com/cve/CVE-2023-49964.htmlhttps://patchthecve.com/cve/CVE-2023-49964.htmlWed, 17 Jun 2026 06:36:47 +0000HIGH 8.8: An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. By inserting malicious content in the folder.get.html.ftl file, an attacker may perform SSTI (Server-Side Template Injection) attacks, which can leverage FreeMarker exposed objects to bypass restrictions and achieve RCE (Remhttps://patchthecve.com/cve/CVE-2021-41792.htmlhttps://patchthecve.com/cve/CVE-2021-41792.htmlWed, 17 Jun 2026 04:08:55 +0000MEDIUM 5.3: An issue was discovered in Hyland org.alfresco:alfresco-content-services through 6.2.2.18 and org.alfresco:alfresco-transform-services through 1.3. A crafted HTML file, once uploaded, could trigger an unexpected request by the transformation engine. The response to the request is not available to thhttps://patchthecve.com/cve/CVE-2021-41790.htmlhttps://patchthecve.com/cve/CVE-2021-41790.htmlWed, 17 Jun 2026 04:08:55 +0000HIGH 8.8: An issue was discovered in Hyland org.alfresco:alfresco-content-services through 7.0.1.2. Script Action execution allows executing scripts uploaded outside of the Data Dictionary. This could allow a logged-in attacker to execute arbitrary code inside a sandboxed environment.