https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2018-9205.htmlhttps://patchthecve.com/cve/CVE-2018-9205.htmlWed, 17 Jun 2026 02:06:13 +0000HIGH 7.5: Vulnerability in avatar_uploader v7.x-1.0-beta8 , The code in view.php doesn't verify users or sanitize the file path.https://patchthecve.com/cve/CVE-2015-2087.htmlhttps://patchthecve.com/cve/CVE-2015-2087.htmlWed, 17 Jun 2026 00:23:34 +0000MEDIUM 6.5: Unrestricted file upload vulnerability in the Avatar Uploader module before 6.x-1.3 for Drupal allows remote authenticated users to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via unspecified vectors.https://patchthecve.com/cve/CVE-2014-9155.htmlhttps://patchthecve.com/cve/CVE-2014-9155.htmlWed, 17 Jun 2026 00:17:50 +0000MEDIUM 4.0: Directory traversal vulnerability in the Avatar Uploader module 6.x-1.x before 6.x-1.2 and 7.x-1.x before 7.x-1.0-beta6 for Drupal allows remote authenticated users to read arbitrary files via a .. (dot dot) in the path of a cropped picture in the uploader panel.