https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-60949.htmlhttps://patchthecve.com/cve/CVE-2025-60949.htmlWed, 17 Jun 2026 09:50:13 +0000CRITICAL 9.1: Census CSWeb 8.0.1 allows "app/config" to be reachable via HTTP in some deployments. A remote, unauthenticated attacker could send requests to configuration files and obtain leaked secrets. Fixed in 8.1.0 alpha.https://patchthecve.com/cve/CVE-2025-60948.htmlhttps://patchthecve.com/cve/CVE-2025-60948.htmlWed, 17 Jun 2026 09:50:13 +0000MEDIUM 4.6: Census CSWeb 8.0.1 allows stored cross-site scripting in user supplied fields. A remote, authenticated attacker could store malicious javascript that executes in a victim's browser. Fixed in 8.1.0 alpha.https://patchthecve.com/cve/CVE-2025-60947.htmlhttps://patchthecve.com/cve/CVE-2025-60947.htmlWed, 17 Jun 2026 09:50:13 +0000HIGH 8.8: Census CSWeb 8.0.1 allows arbitrary file upload. A remote, authenticated attacker could upload a malicious file, possibly leading to remote code execution. Fixed in 8.1.0 alpha.https://patchthecve.com/cve/CVE-2025-60946.htmlhttps://patchthecve.com/cve/CVE-2025-60946.htmlWed, 17 Jun 2026 09:50:12 +0000HIGH 8.8: Census CSWeb 8.0.1 allows arbitrary file path input. A remote, authenticated attacker could access unintended file directories. Fixed in 8.1.0 alpha.