https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-63693.htmlhttps://patchthecve.com/cve/CVE-2025-63693.htmlWed, 17 Jun 2026 09:53:23 +0000MEDIUM 5.4: The comment editing template (dzz/comment/template/edit_form.htm) in DzzOffice 2.3.x lacks adequate security escaping for user-controllable data in multiple contexts, including HTML and JavaScript strings. This allows low-privilege attackers to construct comment content or request parameters and exehttps://patchthecve.com/cve/CVE-2025-63695.htmlhttps://patchthecve.com/cve/CVE-2025-63695.htmlWed, 17 Jun 2026 09:53:23 +0000CRITICAL 9.8: DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php.https://patchthecve.com/cve/CVE-2025-63694.htmlhttps://patchthecve.com/cve/CVE-2025-63694.htmlWed, 17 Jun 2026 09:53:23 +0000CRITICAL 9.8: DzzOffice v2.3.7 and before is vulnerable to SQL Injection in explorer/groupmanage.https://patchthecve.com/cve/CVE-2024-41376.htmlhttps://patchthecve.com/cve/CVE-2024-41376.htmlWed, 17 Jun 2026 07:47:41 +0000HIGH 8.8: dzzoffice 2.02.1 is vulnerable to Directory Traversal via user/space/about.php.https://patchthecve.com/cve/CVE-2024-29273.htmlhttps://patchthecve.com/cve/CVE-2024-29273.htmlWed, 17 Jun 2026 07:22:42 +0000MEDIUM 6.1: There is Stored Cross-Site Scripting (XSS) in dzzoffice 2.02.1 SC UTF8 in uploadfile to index.php, with the XSS payload in an SVG document.