https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2019-18418.htmlhttps://patchthecve.com/cve/CVE-2019-18418.htmlWed, 17 Jun 2026 02:24:59 +0000CRITICAL 9.8: clonos.php in ClonOS WEB control panel 19.09 allows remote attackers to gain full access via change password requests because there is no session management.https://patchthecve.com/cve/CVE-2019-18419.htmlhttps://patchthecve.com/cve/CVE-2019-18419.htmlWed, 17 Jun 2026 02:25:00 +0000MEDIUM 6.1: A cross-site scripting (XSS) vulnerability in index.php in ClonOS WEB control panel 19.09 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.https://patchthecve.com/cve/CVE-2019-15571.htmlhttps://patchthecve.com/cve/CVE-2019-15571.htmlWed, 17 Jun 2026 02:20:39 +0000CRITICAL 9.8: The WEB control panel before 2019-04-30 for ClonOS allows SQL injection in clonos.php.