https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2007-4232.htmlhttps://patchthecve.com/cve/CVE-2007-4232.htmlTue, 16 Jun 2026 22:43:38 +0000MEDIUM 6.8: PHP remote file inclusion vulnerability in admin/inc/change_action.php in Andreas Robertz PHPNews 0.93 allows remote attackers to execute arbitrary PHP code via a URL in the format_menue parameter.https://patchthecve.com/cve/CVE-2006-7081.htmlhttps://patchthecve.com/cve/CVE-2006-7081.htmlTue, 16 Jun 2026 22:34:20 +0000HIGH 7.5: Multiple PHP remote file inclusion vulnerabilities in PhpNews 1.0 allow remote attackers to execute arbitrary PHP code via the Include parameter to (1) Include/lib.inc.php3 and (2) Include/variables.php3.https://patchthecve.com/cve/CVE-2006-6357.htmlhttps://patchthecve.com/cve/CVE-2006-6357.htmlTue, 16 Jun 2026 22:32:57 +0000MEDIUM 6.8: Cross-site scripting (XSS) vulnerability in templates/cat_temp.php in PHPNews 1.3.0 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: The provenance of this information is unknown; the details are obtained solely from third party information.https://patchthecve.com/cve/CVE-2006-6356.htmlhttps://patchthecve.com/cve/CVE-2006-6356.htmlTue, 16 Jun 2026 22:32:57 +0000MEDIUM 6.8: Multiple cross-site scripting (XSS) vulnerabilities in templates/link_temp.php in PHPNews 1.3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) url, (2) id, (3) subject, (4) username, or (5) time parameter.https://patchthecve.com/cve/CVE-2005-2383.htmlhttps://patchthecve.com/cve/CVE-2005-2383.htmlTue, 16 Jun 2026 22:14:47 +0000HIGH 7.5: SQL injection vulnerability in auth.php in PHPNews 1.2.5 allows remote attackers to execute arbitrary SQL commands via the user parameter in an HTTP POST request.https://patchthecve.com/cve/CVE-2005-2156.htmlhttps://patchthecve.com/cve/CVE-2005-2156.htmlTue, 16 Jun 2026 22:14:22 +0000HIGH 7.5: SQL injection vulnerability in news.php in PHPNews 1.2.5 allows remote attackers to execute arbitrary SQL commands via the prevnext parameter.https://patchthecve.com/cve/CVE-2005-0632.htmlhttps://patchthecve.com/cve/CVE-2005-0632.htmlTue, 16 Jun 2026 22:11:29 +0000MEDIUM 5.0: PHP remote file inclusion vulnerability in auth.php in PHPNews 1.2.4 and possibly 1.2.3, allows remote attackers to execute arbitrary PHP code via the path parameter.https://patchthecve.com/cve/CVE-2004-2474.htmlhttps://patchthecve.com/cve/CVE-2004-2474.htmlTue, 16 Jun 2026 22:09:43 +0000HIGH 7.5: SQL injection vulnerability in PHPNews 1.2.3 allows remote attackers to execute arbitrary SQL commands via the mid parameter to sendtofriend.php.