PatchTheCVE: cmswinghttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2021-43736: CmsWing CMS 1.3.7 is affected by a Remote Code Execution (RCE) vulnerability via parameter: log rulehttps://patchthecve.com/cve/CVE-2021-43736.htmlhttps://patchthecve.com/cve/CVE-2021-43736.htmlWed, 17 Jun 2026 04:11:19 +0000CRITICAL 9.8: CmsWing CMS 1.3.7 is affected by a Remote Code Execution (RCE) vulnerability via parameter: log ruleCVE-2021-43735: CmsWing 1.3.7 is affected by a SQLi vulnerability via parameter: behavior rule.https://patchthecve.com/cve/CVE-2021-43735.htmlhttps://patchthecve.com/cve/CVE-2021-43735.htmlWed, 17 Jun 2026 04:11:19 +0000CRITICAL 9.8: CmsWing 1.3.7 is affected by a SQLi vulnerability via parameter: behavior rule.CVE-2020-24993: There is a cross site scripting vulnerability on CmsWing 1.3.7https://patchthecve.com/cve/CVE-2020-24993.htmlhttps://patchthecve.com/cve/CVE-2020-24993.htmlWed, 17 Jun 2026 03:06:13 +0000MEDIUM 5.4: There is a cross site scripting vulnerability on CmsWing 1.3.7. This vulnerability (stored XSS) is triggered when visitors access the article module.CVE-2020-24992: There is a cross site scripting vulnerability on CmsWing 1.3.7https://patchthecve.com/cve/CVE-2020-24992.htmlhttps://patchthecve.com/cve/CVE-2020-24992.htmlWed, 17 Jun 2026 03:06:12 +0000MEDIUM 5.4: There is a cross site scripting vulnerability on CmsWing 1.3.7. This vulnerability (stored XSS) is triggered when an administrator accesses the content management module.CVE-2020-20296: An issue was found in CMSWing project version 1.3.8, Because the rechargeAction function does not check the bahttps://patchthecve.com/cve/CVE-2020-20296.htmlhttps://patchthecve.com/cve/CVE-2020-20296.htmlWed, 17 Jun 2026 03:02:56 +0000CRITICAL 9.8: An issue was found in CMSWing project version 1.3.8, Because the rechargeAction function does not check the balance parameter, malicious parameters can execute arbitrary SQL commands.CVE-2020-20295: An issue was found in CMSWing project version 1.3.8https://patchthecve.com/cve/CVE-2020-20295.htmlhttps://patchthecve.com/cve/CVE-2020-20295.htmlWed, 17 Jun 2026 03:02:56 +0000CRITICAL 9.8: An issue was found in CMSWing project version 1.3.8. Because the updateAction function does not check the detail parameter, malicious parameters can execute arbitrary SQL commands.CVE-2020-20294: An issue was found in CMSWing project version 1.3.8https://patchthecve.com/cve/CVE-2020-20294.htmlhttps://patchthecve.com/cve/CVE-2020-20294.htmlWed, 17 Jun 2026 03:02:56 +0000CRITICAL 9.8: An issue was found in CMSWing project version 1.3.8. Because the log function does not check the log parameter, malicious parameters can execute arbitrary commands.