https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2005-3397.htmlhttps://patchthecve.com/cve/CVE-2005-3397.htmlTue, 16 Jun 2026 22:16:53 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in Comersus BackOffice allows remote attackers to inject arbitrary web script or HTML via the error parameter to comersus_backoffice_supportError.asp. NOTE: the comersus_backoffice_message.asp/message vector is already covered by CVE-2005-2191 item 2.https://patchthecve.com/cve/CVE-2005-0303.htmlhttps://patchthecve.com/cve/CVE-2005-0303.htmlTue, 16 Jun 2026 22:10:52 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in (1) comersus_supportError.asp or (2) comersus_backofficelite_supportError.asp in BackOffice Lite 6.0 and 6.01 allow remote attackers to inject arbitrary web script or HTML via the error parameter.https://patchthecve.com/cve/CVE-2005-0302.htmlhttps://patchthecve.com/cve/CVE-2005-0302.htmlTue, 16 Jun 2026 22:10:52 +0000HIGH 7.5: SQL injection vulnerability in default.asp in BackOffice Lite 6.0 and 6.01 allows remote attackers to execute arbitrary SQL commands via the referer field in the HTTP header.https://patchthecve.com/cve/CVE-2005-0301.htmlhttps://patchthecve.com/cve/CVE-2005-0301.htmlTue, 16 Jun 2026 22:10:52 +0000HIGH 7.5: comersus_backoffice_install10.asp in BackOffice Lite 6.0 and 6.01 allows remote attackers to bypass authentication and gain privileges via a direct request to the program.