https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2007-2080.htmlhttps://patchthecve.com/cve/CVE-2007-2080.htmlTue, 16 Jun 2026 22:38:52 +0000HIGH 7.5: Multiple SQL injection vulnerabilities in XAMPP 1.6.0a for Windows allow remote attackers to execute arbitrary SQL commands via unspecified vectors in certain test scripts.https://patchthecve.com/cve/CVE-2007-2079.htmlhttps://patchthecve.com/cve/CVE-2007-2079.htmlTue, 16 Jun 2026 22:38:52 +0000HIGH 9.3: The ADONewConnection Connect function in adodb.php in XAMPP 1.6.0a and earlier for Windows uses untrusted input for the database server hostname, which allows remote attackers to trigger a library buffer overflow and execute arbitrary code via a long host parameter, or have other unspecified impact.https://patchthecve.com/cve/CVE-2005-2043.htmlhttps://patchthecve.com/cve/CVE-2005-2043.htmlTue, 16 Jun 2026 22:14:07 +0000MEDIUM 5.0: Directory traversal vulnerability in XAMPP before 1.4.14 allows remote attackers to inject arbitrary HTML and PHP code via lang.php.https://patchthecve.com/cve/CVE-2005-1078.htmlhttps://patchthecve.com/cve/CVE-2005-1078.htmlTue, 16 Jun 2026 22:12:23 +0000HIGH 7.5: XAMPP 1.4.x has multiple default or null passwords, which allows attackers to gain privileges.https://patchthecve.com/cve/CVE-2005-1077.htmlhttps://patchthecve.com/cve/CVE-2005-1077.htmlTue, 16 Jun 2026 22:12:23 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in XAMPP 1.4.x allow remote attackers to inject arbitrary web script or HTML via (1) cds.php, (2) Guestbook-EN.pl, or (3) phonebook.php.