https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-12348.htmlhttps://patchthecve.com/cve/CVE-2024-12348.htmlWed, 17 Jun 2026 06:59:32 +0000LOW 3.5: A vulnerability was found in Guizhou Xiaoma Technology jpress 5.1.2. It has been classified as problematic. Affected is the function AttachmentUtils.isUnSafe of the file /commons/attachment/upload of the component Attachment Upload Handler. The manipulation of the argument files[] leads to cross sithttps://patchthecve.com/cve/CVE-2024-11971.htmlhttps://patchthecve.com/cve/CVE-2024-11971.htmlWed, 17 Jun 2026 06:58:48 +0000LOW 3.5: A vulnerability classified as problematic was found in Guizhou Xiaoma Technology jpress 5.1.2. Affected by this vulnerability is an unknown functionality of the file /commons/attachment/upload of the component Avatar Handler. The manipulation of the argument files leads to cross site scripting. The https://patchthecve.com/cve/CVE-2024-50919.htmlhttps://patchthecve.com/cve/CVE-2024-50919.htmlWed, 17 Jun 2026 08:05:08 +0000CRITICAL 9.8: Jpress until v5.1.1 has arbitrary file uploads on the windows platform, and the construction of non-standard file formats such as .jsp. can lead to arbitrary command executionhttps://patchthecve.com/cve/CVE-2024-46468.htmlhttps://patchthecve.com/cve/CVE-2024-46468.htmlWed, 17 Jun 2026 07:55:25 +0000HIGH 7.5: A Server-Side Request Forgery (SSRF) vulnerability exists in the jpress <= v5.1.1, which can be exploited by an attacker to obtain sensitive information, resulting in an information disclosure.https://patchthecve.com/cve/CVE-2024-8304.htmlhttps://patchthecve.com/cve/CVE-2024-8304.htmlWed, 17 Jun 2026 08:22:19 +0000MEDIUM 4.7: A vulnerability has been found in jpress up to 5.1.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/template/edit of the component Template Module Handler. The manipulation leads to path traversal. The attack can be launched remotely. The exhttps://patchthecve.com/cve/CVE-2024-43033.htmlhttps://patchthecve.com/cve/CVE-2024-43033.htmlWed, 17 Jun 2026 07:50:17 +0000HIGH 8.8: JPress through 5.1.1 on Windows has an arbitrary file upload vulnerability that could cause arbitrary code execution via ::$DATA to AttachmentController, such as a .jsp::$DATA file to io.jpress.web.commons.controller.AttachmentController#upload. NOTE: this is unrelated to the attack vector for CVE-2