PatchTheCVE: razorcmshttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2018-19906: Stored XSS exists in razorCMS 3.4.8 via the /#/page description parameter.https://patchthecve.com/cve/CVE-2018-19906.htmlhttps://patchthecve.com/cve/CVE-2018-19906.htmlWed, 17 Jun 2026 01:50:05 +0000MEDIUM 5.4: Stored XSS exists in razorCMS 3.4.8 via the /#/page description parameter.CVE-2018-19905: HTML injection exists in razorCMS 3.4.8 via the /#/page keywords parameter.https://patchthecve.com/cve/CVE-2018-19905.htmlhttps://patchthecve.com/cve/CVE-2018-19905.htmlWed, 17 Jun 2026 01:50:05 +0000MEDIUM 5.4: HTML injection exists in razorCMS 3.4.8 via the /#/page keywords parameter.CVE-2018-17986: rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user.https://patchthecve.com/cve/CVE-2018-17986.htmlhttps://patchthecve.com/cve/CVE-2018-17986.htmlWed, 17 Jun 2026 01:46:39 +0000HIGH 8.8: rars/user/data in razorCMS 3.4.8 allows CSRF for changing the password of an admin user.CVE-2018-16727: razorCMS 3.4.7 allows Stored XSS via the keywords of the homepage within the settings component.https://patchthecve.com/cve/CVE-2018-16727.htmlhttps://patchthecve.com/cve/CVE-2018-16727.htmlWed, 17 Jun 2026 01:44:43 +0000MEDIUM 5.4: razorCMS 3.4.7 allows Stored XSS via the keywords of the homepage within the settings component.CVE-2018-16726: razorCMS 3.4.7 allows HTML injection via the description of the homepage within the settings component.https://patchthecve.com/cve/CVE-2018-16726.htmlhttps://patchthecve.com/cve/CVE-2018-16726.htmlWed, 17 Jun 2026 01:44:43 +0000MEDIUM 5.4: razorCMS 3.4.7 allows HTML injection via the description of the homepage within the settings component.