https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-2728.htmlhttps://patchthecve.com/cve/CVE-2024-2728.htmlWed, 17 Jun 2026 07:25:25 +0000MEDIUM 4.1: Information exposure vulnerability in the CIGESv2 system. This vulnerability could allow a local attacker to intercept traffic due to the lack of proper implementation of the TLS protocol.https://patchthecve.com/cve/CVE-2024-2727.htmlhttps://patchthecve.com/cve/CVE-2024-2727.htmlWed, 17 Jun 2026 07:25:25 +0000MEDIUM 6.1: HTML injection vulnerability affecting the CIGESv2 system, which allows an attacker to inject arbitrary code and modify elements of the website and email confirmation message.https://patchthecve.com/cve/CVE-2024-2726.htmlhttps://patchthecve.com/cve/CVE-2024-2726.htmlWed, 17 Jun 2026 07:25:25 +0000MEDIUM 6.1: Stored Cross-Site Scripting (Stored-XSS) vulnerability affecting the CIGESv2 system, allowing an attacker to execute and store malicious javascript code in the application form without prior registration.https://patchthecve.com/cve/CVE-2024-2725.htmlhttps://patchthecve.com/cve/CVE-2024-2725.htmlWed, 17 Jun 2026 07:25:25 +0000HIGH 7.5: Information exposure vulnerability in the CIGESv2 system. A remote attacker might be able to access /vendor/composer/installed.json and retrieve all installed packages used by the application.https://patchthecve.com/cve/CVE-2024-2724.htmlhttps://patchthecve.com/cve/CVE-2024-2724.htmlWed, 17 Jun 2026 07:25:11 +0000CRITICAL 9.8: SQL injection vulnerability in the CIGESv2 system, through /ajaxServiciosAtencion.php, in the 'idServicio' parameter. The exploitation of this vulnerability could allow a remote user to retrieve all data stored in the database by sending a specially crafted SQL query.https://patchthecve.com/cve/CVE-2024-2723.htmlhttps://patchthecve.com/cve/CVE-2024-2723.htmlWed, 17 Jun 2026 07:25:10 +0000CRITICAL 9.8: SQL injection vulnerability in the CIGESv2 system, through /ajaxSubServicios.php, in the 'idServicio' parameter. The exploitation of this vulnerability could allow a remote user to retrieve all data stored in the database by sending a specially crafted SQL query.https://patchthecve.com/cve/CVE-2024-2722.htmlhttps://patchthecve.com/cve/CVE-2024-2722.htmlWed, 17 Jun 2026 07:25:08 +0000CRITICAL 9.8: SQL injection vulnerability in the CIGESv2 system, through /ajaxConfigTotem.php, in the 'id' parameter. The exploitation of this vulnerability could allow a remote user to retrieve all data stored in the database by sending a specially crafted SQL query.