https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-46655.htmlhttps://patchthecve.com/cve/CVE-2024-46655.htmlWed, 17 Jun 2026 07:55:40 +0000MEDIUM 6.1: A reflected cross-site scripting (XSS) vulnerability in Ellevo 6.2.0.38160 allows attackers to execute arbitrary code in the context of a user's browser via a crafted payload or URL.https://patchthecve.com/cve/CVE-2024-42760.htmlhttps://patchthecve.com/cve/CVE-2024-42760.htmlWed, 17 Jun 2026 07:49:56 +0000HIGH 7.5: SQL Injection vulnerability in Ellevo v.6.2.0.38160 allows a remote attacker to obtain sensitive information via the /api/mob/instrucao/conta/destinatarios component.https://patchthecve.com/cve/CVE-2024-42759.htmlhttps://patchthecve.com/cve/CVE-2024-42759.htmlWed, 17 Jun 2026 07:49:56 +0000MEDIUM 6.3: An issue in Ellevo v.6.2.0.38160 allows a remote attacker to escalate privileges via the /api/usuario/cadastrodesuplente endpoint.