https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-22198.htmlhttps://patchthecve.com/cve/CVE-2026-22198.htmlWed, 17 Jun 2026 10:19:31 +0000MEDIUM 6.1: GestSup versions prior to 3.2.60 contain a pre-authentication stored cross-site scripting (XSS) vulnerability in the API error logging functionality. By sending an API request with a crafted X-API-KEY header value (for example, to /api/v1/ticket.php), an unauthenticated attacker can cause attacker-chttps://patchthecve.com/cve/CVE-2026-22197.htmlhttps://patchthecve.com/cve/CVE-2026-22197.htmlWed, 17 Jun 2026 10:19:31 +0000HIGH 8.1: GestSup versions prior to 3.2.60 contain multiple SQL injection vulnerabilities in the asset list functionality. Multiple request parameters used to filter, search, or sort assets are incorporated into SQL queries without sufficient neutralization, allowing an authenticated attacker to manipulate dahttps://patchthecve.com/cve/CVE-2026-22196.htmlhttps://patchthecve.com/cve/CVE-2026-22196.htmlWed, 17 Jun 2026 10:19:31 +0000HIGH 8.1: GestSup versions prior to 3.2.60 contain a SQL injection vulnerability in ticket creation functionality. User-controlled input provided during ticket creation is incorporated into SQL queries without sufficient neutralization, allowing an authenticated attacker to manipulate database queries. Succeshttps://patchthecve.com/cve/CVE-2026-22195.htmlhttps://patchthecve.com/cve/CVE-2026-22195.htmlWed, 17 Jun 2026 10:19:31 +0000HIGH 8.1: GestSup versions prior to 3.2.60 contain a SQL injection vulnerability in the search bar functionality. User-controlled search input is incorporated into SQL queries without sufficient neutralization, allowing an authenticated attacker to manipulate database queries. Successful exploitation can resuhttps://patchthecve.com/cve/CVE-2026-22194.htmlhttps://patchthecve.com/cve/CVE-2026-22194.htmlWed, 17 Jun 2026 10:19:31 +0000HIGH 8.8: GestSup versions up to and including 3.2.60 contain a cross-site request forgery (CSRF) vulnerability where the application does not verify the authenticity of client requests. An attacker can induce a logged-in user to submit crafted requests that perform actions with the victim's privileges. This