https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2019-25023.htmlhttps://patchthecve.com/cve/CVE-2019-25023.htmlWed, 17 Jun 2026 02:31:30 +0000MEDIUM 6.5: An issue was discovered in Scytl sVote 2.1. Because the IP address from an X-Forwarded-For header (which can be manipulated client-side) is used for the internal application logs, an attacker can inject wrong IP addresses into these logs.https://patchthecve.com/cve/CVE-2019-25022.htmlhttps://patchthecve.com/cve/CVE-2019-25022.htmlWed, 17 Jun 2026 02:31:29 +0000CRITICAL 9.8: An issue was discovered in Scytl sVote 2.1. An attacker can inject code that gets executed by creating an election-event and injecting a payload over an event alias, because the application calls Runtime.getRuntime().exec() without validation.https://patchthecve.com/cve/CVE-2019-25021.htmlhttps://patchthecve.com/cve/CVE-2019-25021.htmlWed, 17 Jun 2026 02:31:29 +0000HIGH 7.5: An issue was discovered in Scytl sVote 2.1. Due to the implementation of the database manager, an attacker can access the OrientDB by providing admin as the admin password. A different password cannot be set because of the implementation in code.https://patchthecve.com/cve/CVE-2019-25020.htmlhttps://patchthecve.com/cve/CVE-2019-25020.htmlWed, 17 Jun 2026 02:31:29 +0000HIGH 7.5: An issue was discovered in Scytl sVote 2.1. Because the sdm-ws-rest API does not require authentication, an attacker can retrieve the administrative configuration by sending a POST request to the /sdm-ws-rest/preconfiguration URI.