https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-15583.htmlhttps://patchthecve.com/cve/CVE-2025-15583.htmlWed, 17 Jun 2026 08:38:04 +0000LOW 3.5: A weakness has been identified in detronetdip E-commerce 1.0.0. This affects the function get_safe_value of the file utility/function.php. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been made available to the public and could be ushttps://patchthecve.com/cve/CVE-2025-15582.htmlhttps://patchthecve.com/cve/CVE-2025-15582.htmlWed, 17 Jun 2026 08:38:04 +0000MEDIUM 5.4: A security flaw has been discovered in detronetdip E-commerce 1.0.0. The impacted element is the function Delete/Update of the component Product Management Module. Performing a manipulation of the argument ID results in authorization bypass. Remote exploitation of the attack is possible. The exploithttps://patchthecve.com/cve/CVE-2026-2165.htmlhttps://patchthecve.com/cve/CVE-2026-2165.htmlWed, 17 Jun 2026 10:30:27 +0000HIGH 7.3: A weakness has been identified in detronetdip E-commerce 1.0.0. Impacted is an unknown function of the file /Admin/assets/backend/seller/add_seller.php of the component Account Creation Endpoint. Executing a manipulation of the argument email can lead to missing authentication. The attack can be exehttps://patchthecve.com/cve/CVE-2026-2164.htmlhttps://patchthecve.com/cve/CVE-2026-2164.htmlWed, 17 Jun 2026 10:30:27 +0000HIGH 7.3: A security flaw has been discovered in detronetdip E-commerce 1.0.0. This issue affects some unknown processing of the file /seller/assets/backend/profile/addadhar.php. Performing a manipulation of the argument File results in unrestricted upload. Remote exploitation of the attack is possible. The ehttps://patchthecve.com/cve/CVE-2025-63883.htmlhttps://patchthecve.com/cve/CVE-2025-63883.htmlWed, 17 Jun 2026 09:53:32 +0000MEDIUM 5.4: A DOM-based cross-site scripting vulnerability exists in electic-shop v1.0 (Bhabishya-123/E-commerce). The site's client-side JavaScript reads attacker-controlled input (for example, values derived from the URL or page fragment) and inserts it into the DOM via unsafe sinks (innerHTML/insertAdjacentH