https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-25478.htmlhttps://patchthecve.com/cve/CVE-2025-25478.htmlWed, 17 Jun 2026 09:00:50 +0000MEDIUM 6.5: The account file upload functionality in Syspass 3.2.x fails to properly handle special characters in filenames. This mismanagement leads to the disclosure of the web application s source code, exposing sensitive information such as the database password.https://patchthecve.com/cve/CVE-2025-25476.htmlhttps://patchthecve.com/cve/CVE-2025-25476.htmlWed, 17 Jun 2026 09:00:49 +0000MEDIUM 5.4: A stored cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows a malicious user with elevated privileges to execute arbitrary Javascript code by specifying a malicious XSS payload as a notification type or notification component.https://patchthecve.com/cve/CVE-2025-25477.htmlhttps://patchthecve.com/cve/CVE-2025-25477.htmlWed, 17 Jun 2026 09:00:49 +0000HIGH 8.1: A host header injection vulnerability in SysPass 3.2x allows an attacker to load malicious JS files from an arbitrary domain which would be executed in the victim's browser.https://patchthecve.com/cve/CVE-2024-42904.htmlhttps://patchthecve.com/cve/CVE-2024-42904.htmlWed, 17 Jun 2026 07:50:06 +0000MEDIUM 6.1: A cross-site scripting (XSS) vulnerability in SysPass 3.2.x allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name parameter at /Controllers/ClientController.php.