https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2008-1651.htmlhttps://patchthecve.com/cve/CVE-2008-1651.htmlTue, 16 Jun 2026 22:52:10 +0000HIGH 7.5: Directory traversal vulnerability in admin/login.php in EasyNews 4.0 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.https://patchthecve.com/cve/CVE-2008-1650.htmlhttps://patchthecve.com/cve/CVE-2008-1650.htmlTue, 16 Jun 2026 22:52:10 +0000HIGH 7.5: SQL injection vulnerability in dynamicpages/index.php in EasyNews 4.0 allows remote attackers to execute arbitrary SQL commands via the read parameter in an edp_Help_Internal_News action.https://patchthecve.com/cve/CVE-2008-1649.htmlhttps://patchthecve.com/cve/CVE-2008-1649.htmlTue, 16 Jun 2026 22:52:10 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in staticpages/easypublish/index.php in EasyNews 4.0 allows remote attackers to inject arbitrary web script or HTML via the read parameter in an edp_pupublish action.https://patchthecve.com/cve/CVE-2007-3331.htmlhttps://patchthecve.com/cve/CVE-2007-3331.htmlTue, 16 Jun 2026 22:41:46 +0000MEDIUM 5.0: Cross-site request forgery (CSRF) vulnerability in STphp EasyNews PRO 4.0 allows remote attackers to change the admin password via (1) a certain HTML form that is posted automatically by JavaScript or (2) a news post.https://patchthecve.com/cve/CVE-2007-3330.htmlhttps://patchthecve.com/cve/CVE-2007-3330.htmlTue, 16 Jun 2026 22:41:46 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in STphp EasyNews PRO 4.0 allows remote attackers to inject arbitrary web script or HTML via a news post, which is stored in news/ without sanitization.https://patchthecve.com/cve/CVE-2006-6866.htmlhttps://patchthecve.com/cve/CVE-2006-6866.htmlTue, 16 Jun 2026 22:33:57 +0000HIGH 7.8: STphp EasyNews PRO 4.0 stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain usernames, email addresses, and password hashes via a direct request for data/users.txt.https://patchthecve.com/cve/CVE-2006-5412.htmlhttps://patchthecve.com/cve/CVE-2006-5412.htmlTue, 16 Jun 2026 22:31:09 +0000MEDIUM 5.1: admin.php in PHP Outburst Easynews 4.4.1 and earlier, when register_globals is enabled, allows remote attackers to bypass authentication, and gain the ability to execute arbitrary code, via the en_login_id parameter.https://patchthecve.com/cve/CVE-2001-1527.htmlhttps://patchthecve.com/cve/CVE-2001-1527.htmlTue, 16 Jun 2026 21:56:26 +0000LOW 2.1: easyNews 1.5 and earlier stores administration passwords in cleartext in settings.php, which allows local users to obtain the passwords and gain access.https://patchthecve.com/cve/CVE-2001-1526.htmlhttps://patchthecve.com/cve/CVE-2001-1526.htmlTue, 16 Jun 2026 21:56:26 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in the comments action in index.php in easyNews 1.5 and earlier allows remote attackers to inject arbitrary web script or HTML via the zeit parameter.https://patchthecve.com/cve/CVE-2001-1525.htmlhttps://patchthecve.com/cve/CVE-2001-1525.htmlTue, 16 Jun 2026 21:56:26 +0000MEDIUM 5.0: Directory traversal vulnerability in the comments action in easyNews 1.5 and earlier allows remote attackers to modify news.dat, template.dat and possibly other files via a ".." in the cid parameter.https://patchthecve.com/cve/CVE-2001-1437.htmlhttps://patchthecve.com/cve/CVE-2001-1437.htmlTue, 16 Jun 2026 21:56:16 +0000HIGH 7.5: easyScripts easyNews 1.5 allows remote attackers to obtain the full path of the web root via a view request with a non-integer news message id field, which leaks the path in a PHP error message when the script times out.