https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-45752.htmlhttps://patchthecve.com/cve/CVE-2025-45752.htmlWed, 17 Jun 2026 09:25:39 +0000HIGH 7.2: A vulnerability in SeedDMS 6.0.32 allows an attacker with admin privileges to execute arbitrary PHP code by exploiting the zip import functionality in the Extension Manager.https://patchthecve.com/cve/CVE-2025-45754.htmlhttps://patchthecve.com/cve/CVE-2025-45754.htmlWed, 17 Jun 2026 09:25:40 +0000MEDIUM 5.4: A stored cross-site scripting (XSS) vulnerability exists in SeedDMS 6.0.32. This vulnerability allows an attacker to inject malicious JavaScript payloads by creating a document with an XSS payload as the document name.https://patchthecve.com/cve/CVE-2025-25461.htmlhttps://patchthecve.com/cve/CVE-2025-25461.htmlWed, 17 Jun 2026 09:00:48 +0000MEDIUM 5.4: A Stored Cross-Site Scripting (XSS) vulnerability exists in SeedDMS 6.0.29. A user or rogue admin with the "Add Category" permission can inject a malicious XSS payload into the category name field. When a document is subsequently associated with this category, the payload is stored on the server andhttps://patchthecve.com/cve/CVE-2024-46409.htmlhttps://patchthecve.com/cve/CVE-2024-46409.htmlWed, 17 Jun 2026 07:55:20 +0000MEDIUM 5.4: A stored cross-site scripting (XSS) vulnerability in SeedDMS v6.0.28 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter in the Calendar page.