https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2007-1142.htmlhttps://patchthecve.com/cve/CVE-2007-1142.htmlTue, 16 Jun 2026 22:37:01 +0000MEDIUM 4.3: Cross-site scripting (XSS) vulnerability in Magic News Plus 1.0.2 allows remote attackers to inject arbitrary web script or HTML via the link_parameters parameter in (1) news.php and (2) n_layouts.php.https://patchthecve.com/cve/CVE-2007-1141.htmlhttps://patchthecve.com/cve/CVE-2007-1141.htmlTue, 16 Jun 2026 22:37:01 +0000HIGH 7.5: PHP remote file inclusion vulnerability in preview.php in Magic News Plus 1.0.2 allows remote attackers to execute arbitrary PHP code via a URL in the php_script_path parameter. NOTE: This issue may overlap CVE-2006-0723.https://patchthecve.com/cve/CVE-2006-0157.htmlhttps://patchthecve.com/cve/CVE-2006-0157.htmlTue, 16 Jun 2026 22:20:00 +0000MEDIUM 5.0: settings.php in Reamday Enterprises Magic News Plus 1.0.3 allows remote attackers to change the administrator password via a change action that specifies identical values for the passwd and admin_password parameters, then declares the new password string in the new_passwd and confirm_passwd paramete