https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-63293.htmlhttps://patchthecve.com/cve/CVE-2025-63293.htmlSun, 05 Jul 2026 02:17:20 +0000MEDIUM 6.5: FairSketch Rise Ultimate Project Manager & CRM 3.9.4 is vulnerable to Insecure Permissions. A remote authenticated user can append comments or upload attachments to tickets for which they lack view or edit authorization, due to missing authorization checks in the ticketing/commenting API.https://patchthecve.com/cve/CVE-2025-60378.htmlhttps://patchthecve.com/cve/CVE-2025-60378.htmlSun, 05 Jul 2026 02:17:07 +0000HIGH 8.1: Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages. Injected content renders in emails, PDFs, and messaging/chat modules sent to clients or team members, enabling phishing, credential theft, and business email chttps://patchthecve.com/cve/CVE-2025-56807.htmlhttps://patchthecve.com/cve/CVE-2025-56807.htmlSun, 05 Jul 2026 02:17:02 +0000MEDIUM 6.1: A cross-site scripting (XSS) vulnerability in FairSketch RISE Ultimate Project Manager & CRM 3.9.4 allows an administrator to store a JavaScript payload using the file explorer in the admin dashboard when creating new folders.https://patchthecve.com/cve/CVE-2025-3855.htmlhttps://patchthecve.com/cve/CVE-2025-3855.htmlWed, 17 Jun 2026 09:20:48 +0000MEDIUM 4.3: A vulnerability was found in CodeCanyon RISE Ultimate Project Manager 3.8.2 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php/team_members/save_profile_image/ of the component Profile Picture Handler. The manipulation of the argument profile_ihttps://patchthecve.com/cve/CVE-2024-8945.htmlhttps://patchthecve.com/cve/CVE-2024-8945.htmlWed, 17 Jun 2026 08:23:36 +0000MEDIUM 5.5: A vulnerability has been found in CodeCanyon RISE Ultimate Project Manager 3.7.0 and classified as critical. This vulnerability affects unknown code of the file /index.php/dashboard/save. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit ha