https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-28597.htmlhttps://patchthecve.com/cve/CVE-2020-28597.htmlWed, 17 Jun 2026 03:10:35 +0000HIGH 7.5: A predictable seed vulnerability exists in the password reset functionality of Epignosis EfrontPro 5.2.21. By predicting the seed it is possible to generate the correct password reset 1-time token. An attacker can visit the password reset supplying the password reset token to reset the password of ahttps://patchthecve.com/cve/CVE-2015-4461.htmlhttps://patchthecve.com/cve/CVE-2015-4461.htmlWed, 17 Jun 2026 00:27:19 +0000MEDIUM 6.5: Absolute path traversal vulnerability in eFront CMS 3.6.15.4 and earlier allows remote Professor users to obtain sensitive information via a full pathname in the other parameter.https://patchthecve.com/cve/CVE-2015-4463.htmlhttps://patchthecve.com/cve/CVE-2015-4463.htmlWed, 17 Jun 2026 00:27:19 +0000MEDIUM 6.5: The file_manager component in eFront CMS before 3.6.15.5 allows remote authenticated users to bypass intended file-upload restrictions by appending a crafted parameter to the file URL.https://patchthecve.com/cve/CVE-2015-4462.htmlhttps://patchthecve.com/cve/CVE-2015-4462.htmlWed, 17 Jun 2026 00:27:19 +0000MEDIUM 6.5: Absolute path traversal vulnerability in the file_manager component of eFront CMS before 3.6.15.5 allows remote authenticated users to read arbitrary files via a full pathname in the "Upload file from url" field in the file manager for professor.php.