https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-66492.htmlhttps://patchthecve.com/cve/CVE-2025-66492.htmlWed, 14 Oct 2026 17:10:00 +0000HIGH 8.2: Masa CMS is an open source Enterprise Content Management platform. Versions 7.2.8 and below, 7.3.1 through 7.3.13, 7.4.0-alpha.1 through 7.4.8 and 7.5.0 through 7.5.1 are vulnerable to XSS when an unsanitized value of the ajax URL query parameter is directly included within the <head> section of thehttps://patchthecve.com/cve/CVE-2024-32643.htmlhttps://patchthecve.com/cve/CVE-2024-32643.htmlSat, 26 Sep 2026 21:10:00 +0000HIGH 7.5: Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, if the URL to the page is modified to include a /tag/ declaration, the CMS will render the page regardless of group restrictions. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6.https://patchthecve.com/cve/CVE-2024-32642.htmlhttps://patchthecve.com/cve/CVE-2024-32642.htmlSat, 26 Sep 2026 21:10:00 +0000HIGH 8.8: Masa CMS is an open source Enterprise Content Management platform. Prior to 7.2.8, 7.3.13, and 7.4.6, there is vulnerable to host header poisoning which allows account takeover via password reset email. This vulnerability is fixed in 7.2.8, 7.3.13, and 7.4.6.https://patchthecve.com/cve/CVE-2024-32641.htmlhttps://patchthecve.com/cve/CVE-2024-32641.htmlSat, 26 Sep 2026 21:10:00 +0000CRITICAL 9.8: Masa CMS is an open source Enterprise Content Management platform. Masa CMS versions prior to 7.2.8, 7.3.13, and 7.4.6 are vulnerable to remote code execution. The vulnerability exists in the addParam function, which accepts user input via the criteria parameter. This input is subsequently evaluated