https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2010-1486.htmlhttps://patchthecve.com/cve/CVE-2010-1486.htmlTue, 16 Jun 2026 23:18:28 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in _invoice.asp in CactuShop before 6.155 allow remote attackers to inject arbitrary web script or HTML via the (1) billing address or (2) shipping address.https://patchthecve.com/cve/CVE-2007-3061.htmlhttps://patchthecve.com/cve/CVE-2007-3061.htmlTue, 16 Jun 2026 22:40:58 +0000HIGH 7.8: Cactushop 6 and earlier stores sensitive information under the web root with insufficient access control, which allows remote attackers to download a database via a direct request for (1) cactushop6.mdb or (2) cactushop5.mdb.https://patchthecve.com/cve/CVE-2006-5991.htmlhttps://patchthecve.com/cve/CVE-2006-5991.htmlTue, 16 Jun 2026 22:32:16 +0000HIGH 7.5: Multiple SQL injection vulnerabilities in wwweb concepts CactuShop allow remote attackers to execute arbitrary SQL commands via the (1) prodtype parameter in prodtype.asp and the (2) product parameter in product.asp.https://patchthecve.com/cve/CVE-2004-1882.htmlhttps://patchthecve.com/cve/CVE-2004-1882.htmlTue, 16 Jun 2026 22:08:35 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in popuplargeimage.asp in CactuShop 5.x allows remote attackers to inject arbitrary web script or HTML via the strImageTag parameter.https://patchthecve.com/cve/CVE-2004-1881.htmlhttps://patchthecve.com/cve/CVE-2004-1881.htmlTue, 16 Jun 2026 22:08:34 +0000HIGH 7.5: SQL injection vulnerability in (1) mailorder.asp or (2) payonline.asp in CactuShop 5.x allows remote attackers to execute arbitrary SQL commands via the strItems parameter.