https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-25915.htmlhttps://patchthecve.com/cve/CVE-2020-25915.htmlWed, 17 Jun 2026 03:07:27 +0000MEDIUM 5.4: Cross Site Scripting (XSS) vulnerability in UserController.php in ThinkCMF version 5.1.5, allows attackers to execute arbitrary code via crafted user_login.https://patchthecve.com/cve/CVE-2022-40849.htmlhttps://patchthecve.com/cve/CVE-2022-40849.htmlWed, 17 Jun 2026 05:02:07 +0000MEDIUM 5.4: ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting (XSS). An attacker who successfully exploited this vulnerability could inject a Persistent XSS payload in the Slideshow Management section that execute arbitrary JavaScript code on the client side, e.g., to steal the administrator's Phttps://patchthecve.com/cve/CVE-2022-40489.htmlhttps://patchthecve.com/cve/CVE-2022-40489.htmlWed, 17 Jun 2026 05:01:27 +0000HIGH 8.8: ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows a Super Administrator user to be injected into administrative users.https://patchthecve.com/cve/CVE-2021-40616.htmlhttps://patchthecve.com/cve/CVE-2021-40616.htmlWed, 17 Jun 2026 04:07:11 +0000MEDIUM 6.5: thinkcmf v5.1.7 has an unauthorized vulnerability. The attacker can modify the password of the administrator account with id 1 through the background user management group permissions. The use condition is that the background user management group authority is required.