https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-51818.htmlhttps://patchthecve.com/cve/CVE-2025-51818.htmlWed, 17 Jun 2026 09:35:50 +0000MEDIUM 5.4: MCCMS 2.7.0 is vulnerable to Arbitrary file deletion in the Backups.php component. This allows an attacker to execute arbitrary commandshttps://patchthecve.com/cve/CVE-2025-50234.htmlhttps://patchthecve.com/cve/CVE-2025-50234.htmlMon, 19 Oct 2026 17:10:00 +0000MEDIUM 6.5: MCCMS v2.7.0 has an SSRF vulnerability located in the index() method of the sys\apps\controllers\api\Gf.php file, where the pic parameter is processed. The pic parameter is decrypted using the sys_auth($pic, 1) function, which utilizes a hard-coded key Mc_Encryption_Key (bD2voYwPpNuJ7B8), defined inhttps://patchthecve.com/cve/CVE-2025-51651.htmlhttps://patchthecve.com/cve/CVE-2025-51651.htmlWed, 17 Jun 2026 09:35:44 +0000MEDIUM 5.5: An authenticated arbitrary file download vulnerability in the component /admin/Backups.php of Mccms v2.7.0 allows attackers to download arbitrary files via a crafted GET request.https://patchthecve.com/cve/CVE-2025-5328.htmlhttps://patchthecve.com/cve/CVE-2025-5328.htmlWed, 17 Jun 2026 09:47:41 +0000MEDIUM 5.4: A vulnerability was found in chshcms mccms 2.7. It has been declared as critical. This vulnerability affects the function restore_del of the file /sys/apps/controllers/admin/Backups.php. The manipulation of the argument dirs leads to path traversal. The attack can be initiated remotely. The exploit https://patchthecve.com/cve/CVE-2025-5327.htmlhttps://patchthecve.com/cve/CVE-2025-5327.htmlWed, 17 Jun 2026 09:47:41 +0000MEDIUM 6.3: A vulnerability was found in chshcms mccms 2.7. It has been classified as critical. This affects the function index of the file sys/apps/controllers/api/Gf.php. The manipulation of the argument pic leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has