https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2007-3293.htmlhttps://patchthecve.com/cve/CVE-2007-3293.htmlTue, 16 Jun 2026 22:41:26 +0000HIGH 7.5: SQL injection vulnerability in categoria.php in LiveCMS 3.4 and earlier allows remote attackers to execute arbitrary SQL commands via the cid parameter.https://patchthecve.com/cve/CVE-2007-3292.htmlhttps://patchthecve.com/cve/CVE-2007-3292.htmlTue, 16 Jun 2026 22:41:25 +0000HIGH 7.5: Unrestricted file upload vulnerability in LiveCMS 3.4 and earlier allows remote attackers to upload and execute arbitrary PHP code by specifying a PHP file type in a parameter intended for "a small image" associated with an article.https://patchthecve.com/cve/CVE-2007-3291.htmlhttps://patchthecve.com/cve/CVE-2007-3291.htmlTue, 16 Jun 2026 22:41:25 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in LiveCMS 3.4 and earlier allows remote attackers to inject arbitrary web script or HTML via an article name, possibly involving the titulo parameter in article.php.https://patchthecve.com/cve/CVE-2007-3290.htmlhttps://patchthecve.com/cve/CVE-2007-3290.htmlTue, 16 Jun 2026 22:41:25 +0000HIGH 9.3: categoria.php in LiveCMS 3.4 and earlier allows remote attackers to obtain sensitive information via a ' (quote) character in the cid parameter, which reveals the path in a forced SQL error message.