https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-56385.htmlhttps://patchthecve.com/cve/CVE-2025-56385.htmlSun, 05 Jul 2026 17:17:17 +0000CRITICAL 9.8: A SQL injection vulnerability exists in the login functionality of WellSky Harmony version 4.1.0.2.83 within the 'xmHarmony.asp' endpoint. User-supplied input to the 'TXTUSERID' parameter is not properly sanitized before being incorporated into a SQL query. Successful authentication may lead to authhttps://patchthecve.com/cve/CVE-2024-55956.htmlhttps://patchthecve.com/cve/CVE-2024-55956.htmlWed, 05 Aug 2026 05:16:42 +0000CRITICAL 9.8: In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash or PowerShell commands on the host system by leveraging the default settings of the Autorun directory.https://patchthecve.com/cve/CVE-2024-50623.htmlhttps://patchthecve.com/cve/CVE-2024-50623.htmlThu, 08 Oct 2026 10:35:08 +0000CRITICAL 9.8: In Cleo Harmony before 5.8.0.21, VLTrader before 5.8.0.21, and LexiCom before 5.8.0.21, there is an unrestricted file upload and download that could lead to remote code execution.