https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2013-7368.htmlhttps://patchthecve.com/cve/CVE-2013-7368.htmlWed, 17 Jun 2026 00:01:50 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in Gnew 2013.1 allow remote attackers to inject arbitrary web script or HTML via the gnew_template parameter to (1) users/profile.php, (2) articles/index.php, or (3) admin/polls.php; (4) category_id parameter to news/submit.php; news_id parameter thttps://patchthecve.com/cve/CVE-2013-7349.htmlhttps://patchthecve.com/cve/CVE-2013-7349.htmlWed, 17 Jun 2026 00:01:48 +0000HIGH 7.5: Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the (1) news_id parameter to news/send.php, (2) thread_id parameter to posts/edit.php, or (3) user_email parameter to users/password.php or (4) users/register.php. NOTE: these issues whttps://patchthecve.com/cve/CVE-2013-5640.htmlhttps://patchthecve.com/cve/CVE-2013-5640.htmlTue, 16 Jun 2026 23:59:09 +0000HIGH 7.5: Multiple SQL injection vulnerabilities in Gnew 2013.1 allow remote attackers to execute arbitrary SQL commands via the (1) answer_id or (2) question_id parameter to polls/vote.php, (3) story_id parameter to comments/add.php or (4) comments/edit.php, or (5) thread_id parameter to posts/add.php. NOTEhttps://patchthecve.com/cve/CVE-2013-5639.htmlhttps://patchthecve.com/cve/CVE-2013-5639.htmlTue, 16 Jun 2026 23:59:09 +0000HIGH 7.5: Directory traversal vulnerability in users/login.php in Gnew 2013.1 and earlier allows remote attackers to read arbitrary files via a .. (dot dot) in the gnew_language cookie.