https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-47532.htmlhttps://patchthecve.com/cve/CVE-2022-47532.htmlWed, 17 Jun 2026 05:13:50 +0000CRITICAL 9.8: FileRun 20220519 allows SQL Injection via the "dir" parameter in a /?module=users&section=cpanel&page=list request.https://patchthecve.com/cve/CVE-2023-28876.htmlhttps://patchthecve.com/cve/CVE-2023-28876.htmlWed, 17 Jun 2026 05:48:58 +0000MEDIUM 4.3: A Broken Access Control issue in comments to uploaded files in Filerun through Update 20220202 allows attackers to delete comments on files uploaded by other users.https://patchthecve.com/cve/CVE-2023-28875.htmlhttps://patchthecve.com/cve/CVE-2023-28875.htmlWed, 17 Jun 2026 05:48:58 +0000MEDIUM 5.4: A Stored XSS issue in shared files download terms in Filerun Update 20220202 allows attackers to inject JavaScript code that is executed when a user follows the crafted share link.https://patchthecve.com/cve/CVE-2022-30469.htmlhttps://patchthecve.com/cve/CVE-2022-30469.htmlWed, 17 Jun 2026 04:43:41 +0000HIGH 8.8: In Afian Filerun 20220202, lack of sanitization of the POST parameter "metadata[]" in `/?module=fileman&section=get&page=grid` leads to SQL injection.https://patchthecve.com/cve/CVE-2022-30470.htmlhttps://patchthecve.com/cve/CVE-2022-30470.htmlWed, 17 Jun 2026 04:43:42 +0000CRITICAL 9.8: In Afian Filerun 20220202 Changing the "search_tika_path" variable to a custom (and previously uploaded) jar file results in remote code execution in the context of the webserver user.