https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2019-7721.htmlhttps://patchthecve.com/cve/CVE-2019-7721.htmlWed, 17 Jun 2026 02:40:53 +0000HIGH 7.5: lib/NCCms.class.php in nc-cms 3.5 allows upload of .php files via the index.php?action=save name and editordata parameters.https://patchthecve.com/cve/CVE-2018-18874.htmlhttps://patchthecve.com/cve/CVE-2018-18874.htmlWed, 17 Jun 2026 01:48:03 +0000CRITICAL 9.8: nc-cms through 2017-03-10 allows remote attackers to execute arbitrary PHP code via the "Upload File or Image" feature, with a .php filename and "Content-Type: application/octet-stream" to the index.php?action=file_manager_upload URI.https://patchthecve.com/cve/CVE-2018-18361.htmlhttps://patchthecve.com/cve/CVE-2018-18361.htmlWed, 17 Jun 2026 01:47:04 +0000MEDIUM 6.1: An issue was discovered in nc-cms through 2017-03-10. index.php?action=edit_html allows XSS via the name parameter, as demonstrated by a value beginning with home_content and containing a crafted SRC attribute of an IMG element.https://patchthecve.com/cve/CVE-2018-18290.htmlhttps://patchthecve.com/cve/CVE-2018-18290.htmlWed, 17 Jun 2026 01:46:57 +0000MEDIUM 4.8: An issue was discovered in nc-cms through 2017-03-10. index.php?action=edit_html&name=home_content allows XSS via the HTML Source Editor. NOTE: the vendor disputes this because the form requires administrator privileges, and entering JavaScript is supported functionality