https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-39094.htmlhttps://patchthecve.com/cve/CVE-2024-39094.htmlWed, 17 Jun 2026 07:41:25 +0000MEDIUM 5.4: Friendica 2024.03 is vulnerable to Cross Site Scripting (XSS) in settings/profile via the homepage, xmpp, and matrix parameters.https://patchthecve.com/cve/CVE-2024-27731.htmlhttps://patchthecve.com/cve/CVE-2024-27731.htmlWed, 17 Jun 2026 07:20:13 +0000MEDIUM 6.1: Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the lack of file type filtering in the file attachment parameter.https://patchthecve.com/cve/CVE-2024-27730.htmlhttps://patchthecve.com/cve/CVE-2024-27730.htmlWed, 17 Jun 2026 07:20:13 +0000CRITICAL 9.8: Insecure Permissions vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information and execute arbitrary code via the cid parameter of the calendar event feature.https://patchthecve.com/cve/CVE-2024-27729.htmlhttps://patchthecve.com/cve/CVE-2024-27729.htmlWed, 17 Jun 2026 07:20:12 +0000MEDIUM 6.1: Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the location parameter of the calendar event feature.https://patchthecve.com/cve/CVE-2024-27728.htmlhttps://patchthecve.com/cve/CVE-2024-27728.htmlWed, 17 Jun 2026 07:20:12 +0000MEDIUM 6.1: Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the text parameter of the babel debug feature.https://patchthecve.com/cve/CVE-2024-26495.htmlhttps://patchthecve.com/cve/CVE-2024-26495.htmlWed, 17 Jun 2026 07:17:45 +0000MEDIUM 6.1: Cross Site Scripting (XSS) vulnerability in Friendica versions after v.2023.12, allows a remote attacker to execute arbitrary code and obtain sensitive information via the BBCode tags in the post content and post comments function.