https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2018-19925.htmlhttps://patchthecve.com/cve/CVE-2018-19925.htmlWed, 17 Jun 2026 01:50:07 +0000CRITICAL 9.8: An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06. It has SQL injection via the member/member_order.php type parameter, related to the O_state parameter.https://patchthecve.com/cve/CVE-2018-19924.htmlhttps://patchthecve.com/cve/CVE-2018-19924.htmlWed, 17 Jun 2026 01:50:07 +0000MEDIUM 6.1: An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06. An email address can be modified in between the request for a validation code and the entry of the validation code, leading to storage of an XSS payload contained in the modified address.https://patchthecve.com/cve/CVE-2018-19923.htmlhttps://patchthecve.com/cve/CVE-2018-19923.htmlWed, 17 Jun 2026 01:50:07 +0000HIGH 8.8: An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06. There is member/member_email.php?action=edit CSRF.https://patchthecve.com/cve/CVE-2018-19654.htmlhttps://patchthecve.com/cve/CVE-2018-19654.htmlWed, 17 Jun 2026 01:49:40 +0000HIGH 7.5: An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06. There is a discrepancy in username checking between a component that does string validation, and a component that is supposed to query a MySQL database. Thus, it is possible to register a new account with a dupli