https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-53913.htmlhttps://patchthecve.com/cve/CVE-2023-53913.htmlWed, 17 Jun 2026 06:46:19 +0000HIGH 8.8: Rukovoditel 3.3.1 contains a CSV injection vulnerability that allows authenticated users to inject malicious formulas into the firstname field. Attackers can craft payloads like =calc|a!z| to trigger code execution when an admin exports customer data as a CSV file.https://patchthecve.com/cve/CVE-2023-53898.htmlhttps://patchthecve.com/cve/CVE-2023-53898.htmlWed, 17 Jun 2026 06:46:17 +0000MEDIUM 5.4: Rukovoditel 3.4.1 contains a stored cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts. Attackers can insert iframe and script payloads in application copyright text to execute arbitrary JavaScript in victim browsers.https://patchthecve.com/cve/CVE-2023-53897.htmlhttps://patchthecve.com/cve/CVE-2023-53897.htmlWed, 17 Jun 2026 06:46:16 +0000MEDIUM 5.4: Rukovoditel 3.4.1 contains multiple stored cross-site scripting vulnerabilities that allow authenticated attackers to inject malicious scripts. Attackers can insert XSS payloads in project task comments to execute arbitrary JavaScript in victim browsers.https://patchthecve.com/cve/CVE-2024-34469.htmlhttps://patchthecve.com/cve/CVE-2024-34469.htmlWed, 17 Jun 2026 07:33:28 +0000HIGH 7.1: Rukovoditel before 3.5.3 allows XSS via user_photo to index.php?module=users/registration&action=save.https://patchthecve.com/cve/CVE-2024-34468.htmlhttps://patchthecve.com/cve/CVE-2024-34468.htmlWed, 17 Jun 2026 07:33:28 +0000MEDIUM 6.1: Rukovoditel before 3.5.3 allows XSS via user_photo to My Page.