PatchTheCVE: syguestbook a5https://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2019-13950: index.php?c=admin&a=index in SyGuestBook A5 Version 1.2 has stored XSS via a reply to a comment.https://patchthecve.com/cve/CVE-2019-13950.htmlhttps://patchthecve.com/cve/CVE-2019-13950.htmlWed, 17 Jun 2026 02:17:29 +0000MEDIUM 5.4: index.php?c=admin&a=index in SyGuestBook A5 Version 1.2 has stored XSS via a reply to a comment.CVE-2019-13949: SyGuestBook A5 Version 1.2 has no CSRF protection mechanism, as demonstrated by CSRF for an index.php?c=Adminihttps://patchthecve.com/cve/CVE-2019-13949.htmlhttps://patchthecve.com/cve/CVE-2019-13949.htmlWed, 17 Jun 2026 02:17:28 +0000HIGH 8.8: SyGuestBook A5 Version 1.2 has no CSRF protection mechanism, as demonstrated by CSRF for an index.php?c=Administrator&a=update admin password change.CVE-2019-13948: SyGuestBook A5 Version 1.2 allows stored XSS because the isValidData function in include/functions.php does nohttps://patchthecve.com/cve/CVE-2019-13948.htmlhttps://patchthecve.com/cve/CVE-2019-13948.htmlWed, 17 Jun 2026 02:17:28 +0000MEDIUM 5.4: SyGuestBook A5 Version 1.2 allows stored XSS because the isValidData function in include/functions.php does not properly block XSS payloads, as demonstrated by a crafted use of the onerror attribute of an IMG element.