https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-28099.htmlhttps://patchthecve.com/cve/CVE-2025-28099.htmlWed, 17 Jun 2026 09:04:33 +0000MEDIUM 4.3: opencms V2.3 is vulnerable to Arbitrary file read in src/main/webapp/view/admin/document/dataPage.jsp,https://patchthecve.com/cve/CVE-2024-42699.htmlhttps://patchthecve.com/cve/CVE-2024-42699.htmlWed, 17 Jun 2026 07:49:53 +0000MEDIUM 6.5: Cross Site Scripting vulnerability in Create/Modify article function in Alkacon OpenCMS 17.0 allows remote attacker to inject javascript payload via image title sub-field in the image fieldhttps://patchthecve.com/cve/CVE-2024-41446.htmlhttps://patchthecve.com/cve/CVE-2024-41446.htmlSun, 05 Jul 2026 16:19:05 +0000MEDIUM 5.4: A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the image parameter under the Create/Modify article function.https://patchthecve.com/cve/CVE-2024-41447.htmlhttps://patchthecve.com/cve/CVE-2024-41447.htmlWed, 17 Jun 2026 07:47:43 +0000MEDIUM 5.4: A stored cross-site scripting (XSS) vulnerability in Alkacon OpenCMS v17.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the author parameter under the Create/Modify article function.https://patchthecve.com/cve/CVE-2025-3317.htmlhttps://patchthecve.com/cve/CVE-2025-3317.htmlWed, 17 Jun 2026 09:19:39 +0000MEDIUM 4.3: A vulnerability classified as problematic has been found in fumiao opencms up to a0fafa5cff58719e9b27c2a2eec204cc165ce14f. Affected is an unknown function of the file opencms-dev/src/main/webapp/view/admin/document/dataPage.jsp. The manipulation of the argument path leads to path traversal. It is pohttps://patchthecve.com/cve/CVE-2025-0708.htmlhttps://patchthecve.com/cve/CVE-2025-0708.htmlWed, 17 Jun 2026 08:27:00 +0000LOW 3.5: A vulnerability was found in fumiao opencms 2.2. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/model/addOrUpdate of the component Add Model Management Page. The manipulation of the argument 模板前缀 leads to cross site scripting. The attack can be initia