https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-5108.htmlhttps://patchthecve.com/cve/CVE-2025-5108.htmlWed, 17 Jun 2026 09:47:12 +0000MEDIUM 6.3: A vulnerability was found in zongzhige ShopXO 6.5.0. It has been rated as critical. This issue affects the function Upload of the file app/admin/controller/Payment.php of the component ZIP File Handler. The manipulation of the argument params leads to unrestricted upload. The attack may be initiatedhttps://patchthecve.com/cve/CVE-2025-28094.htmlhttps://patchthecve.com/cve/CVE-2025-28094.htmlWed, 17 Jun 2026 09:04:33 +0000MEDIUM 6.5: shopxo v6.4.0 has a ssrf/xss vulnerability in multiple places.https://patchthecve.com/cve/CVE-2025-28093.htmlhttps://patchthecve.com/cve/CVE-2025-28093.htmlWed, 17 Jun 2026 09:04:33 +0000MEDIUM 6.3: ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) in Email Settings.https://patchthecve.com/cve/CVE-2025-28092.htmlhttps://patchthecve.com/cve/CVE-2025-28092.htmlWed, 17 Jun 2026 09:04:33 +0000MEDIUM 6.3: ShopXO v6.4.0 is vulnerable to Server-Side Request Forgery (SSRF) via image upload function.https://patchthecve.com/cve/CVE-2025-26325.htmlhttps://patchthecve.com/cve/CVE-2025-26325.htmlWed, 17 Jun 2026 09:01:35 +0000CRITICAL 9.8: ShopXO 6.4.0 is vulnerable to File Upload in ThemeDataService.php.https://patchthecve.com/cve/CVE-2025-1611.htmlhttps://patchthecve.com/cve/CVE-2025-1611.htmlWed, 17 Jun 2026 08:39:27 +0000MEDIUM 4.7: A vulnerability was found in ShopXO up to 6.4.0. It has been classified as problematic. This affects an unknown part of the file app/service/ThemeAdminService.php of the component Template Handler. The manipulation leads to injection. It is possible to initiate the attack remotely. The exploit has bhttps://patchthecve.com/cve/CVE-2024-44682.htmlhttps://patchthecve.com/cve/CVE-2024-44682.htmlWed, 17 Jun 2026 07:53:01 +0000MEDIUM 6.1: ShopXO 6.2 is vulnerable to Cross Site Scripting (XSS) in the backend that allows attackers to execute code by changing POST parameters.https://patchthecve.com/cve/CVE-2024-6524.htmlhttps://patchthecve.com/cve/CVE-2024-6524.htmlWed, 17 Jun 2026 08:18:10 +0000MEDIUM 5.5: A vulnerability was found in ShopXO up to 6.1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file extend/base/Uploader.php. The manipulation of the argument source leads to server-side request forgery. The attack can be launched remotely. The e