https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2009-4793.htmlhttps://patchthecve.com/cve/CVE-2009-4793.htmlTue, 16 Jun 2026 23:14:22 +0000MEDIUM 6.0: Unrestricted file upload vulnerability in adminpanel/scripts/addphotos.php in BandSite CMS 1.1.4 allows remote authenticated administrators to execute arbitrary PHP code by uploading a file with an executable extension via an addphotos action to adminpanel/index.php, and then accessing the file via https://patchthecve.com/cve/CVE-2009-4792.htmlhttps://patchthecve.com/cve/CVE-2009-4792.htmlTue, 16 Jun 2026 23:14:22 +0000HIGH 7.5: SQL injection vulnerability in includes/content/member_content.php in BandSite CMS 1.1.4 allows remote attackers to execute arbitrary SQL commands via the memid parameter to members.php.https://patchthecve.com/cve/CVE-2008-7058.htmlhttps://patchthecve.com/cve/CVE-2008-7058.htmlTue, 16 Jun 2026 23:03:30 +0000MEDIUM 6.8: Cross-site request forgery (CSRF) vulnerability in BandSite CMS 1.1.4 allows remote attackers to hijack the authentication of administrators and force a logout via adminpanel/logout.php.https://patchthecve.com/cve/CVE-2008-7057.htmlhttps://patchthecve.com/cve/CVE-2008-7057.htmlTue, 16 Jun 2026 23:03:30 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in merchandise.php in BandSite CMS 1.1.4 allows remote attackers to inject arbitrary HTML or web script via the type parameter.https://patchthecve.com/cve/CVE-2008-7056.htmlhttps://patchthecve.com/cve/CVE-2008-7056.htmlTue, 16 Jun 2026 23:03:30 +0000MEDIUM 5.0: BandSite CMS 1.1.4 does not perform access control for adminpanel/phpmydump.php, which allows remote attackers to obtain copies of the database via a direct request.https://patchthecve.com/cve/CVE-2008-5497.htmlhttps://patchthecve.com/cve/CVE-2008-5497.htmlTue, 16 Jun 2026 23:00:07 +0000HIGH 7.5: BandSite CMS 1.1.4 allows remote attackers to bypass authentication and gain administrative access by setting the login_auth cookie to true.