https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2019-20152.htmlhttps://patchthecve.com/cve/CVE-2019-20152.htmlWed, 17 Jun 2026 02:30:01 +0000MEDIUM 6.1: An XSS issue was discovered in TreasuryXpress 19191105. Due to the lack of filtering and sanitization of user input, malicious JavaScript can be executed throughout the application. A malicious payload can be injected within the Custom Workflow component and inserted via the Create New Workflow fielhttps://patchthecve.com/cve/CVE-2019-20151.htmlhttps://patchthecve.com/cve/CVE-2019-20151.htmlWed, 17 Jun 2026 02:30:01 +0000MEDIUM 6.1: An XSS issue was discovered in TreasuryXpress 19191105. Due to the lack of filtering and sanitization of user input, malicious JavaScript can be executed by the application's administrator(s). A malicious payload can be injected within the Multi Approval security component and inserted via the Note https://patchthecve.com/cve/CVE-2019-20150.htmlhttps://patchthecve.com/cve/CVE-2019-20150.htmlWed, 17 Jun 2026 02:30:00 +0000MEDIUM 6.5: In TreasuryXpress 19191105, a logged-in user can discover saved credentials, even though the UI hides them. Using functionality within the application and a malicious host, it is possible to force the application to expose saved SSH/SFTP credentials. This can be done by using the application's edito