PatchTheCVE: bancohttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2018-14929: Matera Banco 1.0.0 is vulnerable to multiple reflected XSS, as demonstrated by the /contingency/web/index.jsp https://patchthecve.com/cve/CVE-2018-14929.htmlhttps://patchthecve.com/cve/CVE-2018-14929.htmlWed, 17 Jun 2026 01:41:54 +0000MEDIUM 6.1: Matera Banco 1.0.0 is vulnerable to multiple reflected XSS, as demonstrated by the /contingency/web/index.jsp (aka home page) url parameter.CVE-2018-14928: /contingency/servlet/ServletFileDownload executes as root and provides unauthenticated access to files via thehttps://patchthecve.com/cve/CVE-2018-14928.htmlhttps://patchthecve.com/cve/CVE-2018-14928.htmlWed, 17 Jun 2026 01:41:54 +0000HIGH 7.5: /contingency/servlet/ServletFileDownload executes as root and provides unauthenticated access to files via the file parameter.CVE-2018-14927: Matera Banco 1.0.0 is vulnerable to path traversal (allowing access to system files outside the default applichttps://patchthecve.com/cve/CVE-2018-14927.htmlhttps://patchthecve.com/cve/CVE-2018-14927.htmlWed, 17 Jun 2026 01:41:53 +0000MEDIUM 5.3: Matera Banco 1.0.0 is vulnerable to path traversal (allowing access to system files outside the default application folder) via the /contingency/servlet/ServletFileDownload file parameter, related to /contingency/web/receiptQuery/receiptDisplay.jsp.CVE-2018-14926: Matera Banco 1.0.0 allows CSRF, as demonstrated by a /contingency/web/messageSend/messageSendHandler.jsp requehttps://patchthecve.com/cve/CVE-2018-14926.htmlhttps://patchthecve.com/cve/CVE-2018-14926.htmlWed, 17 Jun 2026 01:41:53 +0000HIGH 8.8: Matera Banco 1.0.0 allows CSRF, as demonstrated by a /contingency/web/messageSend/messageSendHandler.jsp request.CVE-2018-14925: Matera Banco 1.0.0 mishandles Java errors in the backend, as demonstrated by a stack trace revealing use of nehttps://patchthecve.com/cve/CVE-2018-14925.htmlhttps://patchthecve.com/cve/CVE-2018-14925.htmlWed, 17 Jun 2026 01:41:53 +0000CRITICAL 9.8: Matera Banco 1.0.0 mishandles Java errors in the backend, as demonstrated by a stack trace revealing use of net.sf.acegisecurity components.CVE-2018-14924: Matera Banco 1.0.0 is vulnerable to multiple stored XSS, as demonstrated by the sca/privilegio/consultarUsuarihttps://patchthecve.com/cve/CVE-2018-14924.htmlhttps://patchthecve.com/cve/CVE-2018-14924.htmlWed, 17 Jun 2026 01:41:53 +0000MEDIUM 6.1: Matera Banco 1.0.0 is vulnerable to multiple stored XSS, as demonstrated by the sca/privilegio/consultarUsuario.jsf "Nome Completo" (aka user fullname) field.