https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-2495.htmlhttps://patchthecve.com/cve/CVE-2025-2495.htmlWed, 17 Jun 2026 09:07:03 +0000MEDIUM 5.4: Stored Cross-Site Scripting (XSS) in Softdial Contact Center of Sytel Ltd. This vulnerability allows an attacker to upload XML files to the server with JavaScript code injected via the ‘/softdial/scheduler/save.php’ resource. The injected code will execute when the uploaded file is loaded via the ‘/https://patchthecve.com/cve/CVE-2025-2494.htmlhttps://patchthecve.com/cve/CVE-2025-2494.htmlWed, 17 Jun 2026 09:07:03 +0000CRITICAL 9.8: Unrestricted file upload to Softdial Contact Center of Sytel Ltd. This vulnerability could allow an attacker to upload files to the server via the ‘/softdial/phpconsole/upload.php’ endpoint, which is protected by basic HTTP authentication. The files are uploaded to a directory exposed by the web apphttps://patchthecve.com/cve/CVE-2025-2493.htmlhttps://patchthecve.com/cve/CVE-2025-2493.htmlWed, 17 Jun 2026 09:07:03 +0000HIGH 7.5: Path Traversal vulnerability in Softdial Contact Center of Sytel Ltd. This vulnerability allows an attacker to manipulate the ‘id’ parameter of the ‘/softdial/scheduler/load.php’ endpoint to navigate beyond the intended directory. This can allow unauthorised access to sensitive files outside the exp