PatchTheCVE: picuploaderhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2024-44796: A cross-site scripting (XSS) vulnerability in the component /auth/AzureRedirect.php of PicUploader commit fcf8https://patchthecve.com/cve/CVE-2024-44796.htmlhttps://patchthecve.com/cve/CVE-2024-44796.htmlSun, 05 Jul 2026 01:20:30 +0000MEDIUM 6.1: A cross-site scripting (XSS) vulnerability in the component /auth/AzureRedirect.php of PicUploader commit fcf82ea allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the error_description parameter.CVE-2024-44794: A cross-site scripting (XSS) vulnerability in the component /master/auth/OnedriveRedirect.php of PicUploader chttps://patchthecve.com/cve/CVE-2024-44794.htmlhttps://patchthecve.com/cve/CVE-2024-44794.htmlSun, 05 Jul 2026 01:20:29 +0000MEDIUM 6.1: A cross-site scripting (XSS) vulnerability in the component /master/auth/OnedriveRedirect.php of PicUploader commit fcf82ea allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the error_description parameter.CVE-2022-41442: PicUploader v2.6.3 was discovered to contain cross-site scripting (XSS) vulnerability via the setStorageParamshttps://patchthecve.com/cve/CVE-2022-41442.htmlhttps://patchthecve.com/cve/CVE-2022-41442.htmlWed, 17 Jun 2026 05:03:13 +0000MEDIUM 6.1: PicUploader v2.6.3 was discovered to contain cross-site scripting (XSS) vulnerability via the setStorageParams function in SettingController.php.CVE-2022-36748: PicUploader v2.6.3 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /mashttps://patchthecve.com/cve/CVE-2022-36748.htmlhttps://patchthecve.com/cve/CVE-2022-36748.htmlWed, 17 Jun 2026 04:53:55 +0000MEDIUM 6.1: PicUploader v2.6.3 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /master/index.php.