https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-11853.htmlhttps://patchthecve.com/cve/CVE-2025-11853.htmlWed, 17 Jun 2026 08:31:18 +0000MEDIUM 6.3: A vulnerability was determined in Sismics Teedy up to 1.11. This affects an unknown function of the file /api/file of the component API Endpoint. Executing a manipulation can lead to improper access controls. The attack may be performed from remote. The exploit has been publicly disclosed and may behttps://patchthecve.com/cve/CVE-2024-54852.htmlhttps://patchthecve.com/cve/CVE-2024-54852.htmlWed, 17 Jun 2026 08:10:45 +0000CRITICAL 9.8: When LDAP connection is activated in Teedy versions between 1.9 to 1.12, the username field of the login form is vulnerable to LDAP injection. Due to improper sanitization of user input, an unauthenticated attacker is then able to perform various malicious actions, such as creating arbitrary accounthttps://patchthecve.com/cve/CVE-2024-54851.htmlhttps://patchthecve.com/cve/CVE-2024-54851.htmlWed, 17 Jun 2026 08:10:45 +0000HIGH 8.8: Teedy <= 1.12 is vulnerable to Cross Site Request Forgery (CSRF), due to the lack of CSRF protection.https://patchthecve.com/cve/CVE-2025-22963.htmlhttps://patchthecve.com/cve/CVE-2025-22963.htmlWed, 17 Jun 2026 08:51:14 +0000HIGH 7.5: Teedy through 1.11 allows CSRF for account takeover via POST /api/user/admin.https://patchthecve.com/cve/CVE-2024-46278.htmlhttps://patchthecve.com/cve/CVE-2024-46278.htmlWed, 17 Jun 2026 07:55:15 +0000HIGH 8.4: Teedy 1.11 is vulnerable to Cross Site Scripting (XSS) via the management console.