https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-11914.htmlhttps://patchthecve.com/cve/CVE-2025-11914.htmlThu, 08 Oct 2026 22:10:00 +0000MEDIUM 4.3: A vulnerability was found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. Affected by this issue is the function Download of the file /DeviceFileReport.do?Action=Download. Performing manipulation of the argument FilePath results in path traversal. The attack may be initiated remotely. The exphttps://patchthecve.com/cve/CVE-2025-11913.htmlhttps://patchthecve.com/cve/CVE-2025-11913.htmlThu, 08 Oct 2026 22:10:00 +0000MEDIUM 4.3: A vulnerability has been found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. Affected by this vulnerability is the function Download of the file /Service.do?Action=Download. Such manipulation of the argument Path leads to path traversal. The attack can be launched remotely. The exploit has https://patchthecve.com/cve/CVE-2025-11912.htmlhttps://patchthecve.com/cve/CVE-2025-11912.htmlThu, 08 Oct 2026 22:10:00 +0000MEDIUM 6.3: A flaw has been found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. Affected is the function Query of the file /DeviceState.do?Action=Query. This manipulation of the argument orderField causes sql injection. The attack can be initiated remotely. The exploit has been published and may be usehttps://patchthecve.com/cve/CVE-2025-11911.htmlhttps://patchthecve.com/cve/CVE-2025-11911.htmlThu, 08 Oct 2026 22:10:00 +0000MEDIUM 6.3: A vulnerability was detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. This impacts the function Query of the file /DeviceFault.do?Action=Query. The manipulation of the argument sortField results in sql injection. It is possible to launch the attack remotely. The exploit is now public ahttps://patchthecve.com/cve/CVE-2025-11910.htmlhttps://patchthecve.com/cve/CVE-2025-11910.htmlThu, 08 Oct 2026 22:10:00 +0000MEDIUM 6.3: A security vulnerability has been detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. This affects the function Query of the file /MemoryState.do?Action=Query. The manipulation of the argument orderField leads to sql injection. It is possible to initiate the attack remotely. The exploit https://patchthecve.com/cve/CVE-2025-11909.htmlhttps://patchthecve.com/cve/CVE-2025-11909.htmlThu, 08 Oct 2026 22:10:00 +0000MEDIUM 6.3: A weakness has been identified in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. The impacted element is the function queryLast of the file /RepairRecord.do?Action=QueryLast. Executing manipulation of the argument orderField can lead to sql injection. The attack may be performed from remote. Thhttps://patchthecve.com/cve/CVE-2025-11908.htmlhttps://patchthecve.com/cve/CVE-2025-11908.htmlThu, 08 Oct 2026 22:10:00 +0000MEDIUM 6.3: A security flaw has been discovered in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. The affected element is the function uploadFile of the file /FileDir.do?Action=Upload. Performing manipulation of the argument File results in unrestricted upload. The attack is possible to be carried out remo