https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2007-0347.htmlhttps://patchthecve.com/cve/CVE-2007-0347.htmlTue, 16 Jun 2026 22:35:24 +0000MEDIUM 4.3: The is_eow function in format.c in CVSTrac before 2.0.1 does not properly check for the "'" (quote) character, which allows remote authenticated users to execute limited SQL injection attacks and cause a denial of service (database error) via a ' character in certain messages, tickets, or Wiki entrihttps://patchthecve.com/cve/CVE-2004-1456.htmlhttps://patchthecve.com/cve/CVE-2004-1456.htmlTue, 16 Jun 2026 22:07:44 +0000HIGH 7.5: filediff in CVStrac allows remote attackers to execute arbitrary commands via shell metacharacters in rcsinfo.https://patchthecve.com/cve/CVE-2004-1146.htmlhttps://patchthecve.com/cve/CVE-2004-1146.htmlTue, 16 Jun 2026 22:07:08 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in (1) main.c and (2) login.c for CVSTrac before 1.1.5 allow remote attackers to inject arbitrary HTML and web script.