https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-25912.htmlhttps://patchthecve.com/cve/CVE-2020-25912.htmlThu, 09 Jul 2026 00:17:02 +0000CRITICAL 9.1: A XML External Entity (XXE) vulnerability was discovered in symphony\lib\toolkit\class.xmlelement.php in Symphony 2.7.10 which can lead to an information disclosure or denial of service (DOS).https://patchthecve.com/cve/CVE-2020-25343.htmlhttps://patchthecve.com/cve/CVE-2020-25343.htmlWed, 17 Jun 2026 03:06:44 +0000MEDIUM 5.4: Cross-site scripting (XSS) vulnerabilities in Symphony CMS 3.0.0 allow remote attackers to inject arbitrary web script or HTML to fields['body'] param via events\event.publish_article.phphttps://patchthecve.com/cve/CVE-2020-17405.htmlhttps://patchthecve.com/cve/CVE-2020-17405.htmlWed, 17 Jun 2026 02:58:52 +0000HIGH 8.8: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Senstar Symphony 7.3.2.2. Authentication is not required to exploit this vulnerability. The specific flaw exists within the SSOAuth process. The issue results from the lack of proper validatiohttps://patchthecve.com/cve/CVE-2020-15071.htmlhttps://patchthecve.com/cve/CVE-2020-15071.htmlWed, 17 Jun 2026 02:56:00 +0000MEDIUM 6.1: content/content.blueprintsevents.php in Symphony CMS 3.0.0 allows XSS via fields['name'] to appendSubheading.https://patchthecve.com/cve/CVE-2019-17488.htmlhttps://patchthecve.com/cve/CVE-2019-17488.htmlWed, 17 Jun 2026 02:23:59 +0000MEDIUM 6.1: b3log Symphony (aka Sym) before 3.6.0 has XSS via the HTTP User-Agent header.https://patchthecve.com/cve/CVE-2018-16249.htmlhttps://patchthecve.com/cve/CVE-2018-16249.htmlWed, 17 Jun 2026 01:43:57 +0000MEDIUM 4.8: In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated user https://patchthecve.com/cve/CVE-2019-9142.htmlhttps://patchthecve.com/cve/CVE-2019-9142.htmlWed, 17 Jun 2026 02:43:08 +0000MEDIUM 6.1: An issue was discovered in b3log Symphony (aka Sym) before v3.4.7. XSS exists via the userIntro and userNickname fields to processor/SettingsProcessor.java.https://patchthecve.com/cve/CVE-2018-12043.htmlhttps://patchthecve.com/cve/CVE-2018-12043.htmlWed, 17 Jun 2026 01:37:03 +0000MEDIUM 6.1: content/content.blueprintspages.php in Symphony 2.7.6 has XSS via the pages content page.https://patchthecve.com/cve/CVE-2017-16956.htmlhttps://patchthecve.com/cve/CVE-2017-16956.htmlWed, 17 Jun 2026 01:10:12 +0000MEDIUM 6.1: b3log Symphony (aka Sym) 2.2.0 allows an XSS attack by sending a private letter with a certain /article URI, and a second private letter with a modified title.https://patchthecve.com/cve/CVE-2017-16881.htmlhttps://patchthecve.com/cve/CVE-2017-16881.htmlWed, 17 Jun 2026 01:10:05 +0000MEDIUM 6.1: b3log Symphony (aka Sym) 2.2.0 does not properly address XSS in JSON objects, as demonstrated by a crafted userAvatarURL value to /settings/avatar, related to processor/AdminProcessor.java, processor/ArticleProcessor.java, processor/UserProcessor.java, service/ArticleQueryService.java, service/Avatahttps://patchthecve.com/cve/CVE-2017-16821.htmlhttps://patchthecve.com/cve/CVE-2017-16821.htmlWed, 17 Jun 2026 01:09:58 +0000MEDIUM 5.4: b3log Symphony (aka Sym) 2.2.0 has XSS in processor/AdminProcessor.java in the admin console, as demonstrated by a crafted X-Forwarded-For HTTP header that is mishandled during display of a client IP address in /admin/user/userid.https://patchthecve.com/cve/CVE-2017-8876.htmlhttps://patchthecve.com/cve/CVE-2017-8876.htmlWed, 17 Jun 2026 01:27:07 +0000MEDIUM 6.1: Symphony 2 2.6.11 has XSS in the meta[navigation_group] parameter to content/content.blueprintssections.php.https://patchthecve.com/cve/CVE-2017-7694.htmlhttps://patchthecve.com/cve/CVE-2017-7694.htmlWed, 17 Jun 2026 01:25:00 +0000HIGH 8.8: Remote Code Execution vulnerability in symphony/content/content.blueprintsdatasources.php in Symphony CMS through 2.6.11 allows remote attackers to execute code and get a webshell from the back-end. The attacker must be authenticated and enter PHP code in the datasource editor or event editor.https://patchthecve.com/cve/CVE-2017-6067.htmlhttps://patchthecve.com/cve/CVE-2017-6067.htmlWed, 17 Jun 2026 01:21:44 +0000MEDIUM 6.1: Symphony 2.6.9 has XSS in publish/notes/edit/##/saved/ via the bottom form field.