https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2011-5276.htmlhttps://patchthecve.com/cve/CVE-2011-5276.htmlTue, 16 Jun 2026 23:36:16 +0000MEDIUM 6.5: SQL injection vulnerability in the drawAdminTools_PackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control (DTC) before 0.32.11 allows remote authenticated users to execute arbitrary SQL commands via the database_name parameter.https://patchthecve.com/cve/CVE-2011-5275.htmlhttps://patchthecve.com/cve/CVE-2011-5275.htmlTue, 16 Jun 2026 23:36:16 +0000HIGH 7.5: The install script in Domain Technologie Control (DTC) before 0.34.1 gives sudo permissions for chrootuid to the dtc user, which makes it easier for context-dependent users to gain privileges.https://patchthecve.com/cve/CVE-2011-5274.htmlhttps://patchthecve.com/cve/CVE-2011-5274.htmlTue, 16 Jun 2026 23:36:16 +0000HIGH 7.5: The drawAdminTools_PackageInstaller function in shared/inc/forms/packager.php in Domain Technologie Control (DTC) before 0.32.11 allows remote attackers to execute arbitrary commands via shell metacharacters in the dtcpkg_directory parameter in a do_install action to dtc/.https://patchthecve.com/cve/CVE-2011-5273.htmlhttps://patchthecve.com/cve/CVE-2011-5273.htmlTue, 16 Jun 2026 23:36:16 +0000MEDIUM 6.5: Directory traversal vulnerability in shared/package-installer in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary PHP code via a .. (dot dot) in the pkg parameter in a do_install action to dtc/.https://patchthecve.com/cve/CVE-2011-5272.htmlhttps://patchthecve.com/cve/CVE-2011-5272.htmlTue, 16 Jun 2026 23:36:15 +0000MEDIUM 6.5: SQL injection vulnerability in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary SQL commands via the vps_note parameter to dtcadmin/logPushlet.php. NOTE: this issue was originally part of CVE-2011-3197, but that ID was SPLIT due to different resehttps://patchthecve.com/cve/CVE-2011-3199.htmlhttps://patchthecve.com/cve/CVE-2011-3199.htmlTue, 16 Jun 2026 23:32:51 +0000LOW 3.5: Multiple cross-site scripting (XSS) vulnerabilities in Domain Technologie Control (DTC) before 0.34.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) message body of a support ticket or unspecified vectors to the (2) DNS and (3) MX form, as demonstrated by the "Dohttps://patchthecve.com/cve/CVE-2011-3198.htmlhttps://patchthecve.com/cve/CVE-2011-3198.htmlTue, 16 Jun 2026 23:32:51 +0000LOW 2.1: Domain Technologie Control (DTC) before 0.34.1 includes a password in the -b command line argument to htpasswd, which might allow local users to read the password by listing the process and its arguments.https://patchthecve.com/cve/CVE-2011-3197.htmlhttps://patchthecve.com/cve/CVE-2011-3197.htmlTue, 16 Jun 2026 23:32:51 +0000MEDIUM 6.5: SQL injection vulnerability in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary SQL commands via the addrlink parameter to shared/inc/forms/domain_info.php. NOTE: CVE-2011-3197 has been SPLIT due to findings by different researchers. CVE-2011-527https://patchthecve.com/cve/CVE-2011-3196.htmlhttps://patchthecve.com/cve/CVE-2011-3196.htmlTue, 16 Jun 2026 23:32:51 +0000LOW 2.1: The setup script in Domain Technologie Control (DTC) before 0.34.1 uses world-readable permissions for /etc/apache2/apache2.conf, which allows local users to obtain the dtcdaemons MySQL password by reading the file.https://patchthecve.com/cve/CVE-2011-3195.htmlhttps://patchthecve.com/cve/CVE-2011-3195.htmlTue, 16 Jun 2026 23:32:51 +0000MEDIUM 6.5: shared/inc/sql/lists.php in Domain Technologie Control (DTC) before 0.34.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in mailing list tunable options.