https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-71166.htmlhttps://patchthecve.com/cve/CVE-2025-71166.htmlTue, 14 Jul 2026 23:17:28 +0000MEDIUM 5.4: Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface within the Tools Status move message handling. The path parameter is reflected into the HTML output without proper output encoding in include/admin/Tools/Statuhttps://patchthecve.com/cve/CVE-2025-71165.htmlhttps://patchthecve.com/cve/CVE-2025-71165.htmlTue, 14 Jul 2026 23:17:28 +0000MEDIUM 5.4: Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface within the Tools Status functionality. The path parameter is reflected into the HTML response without proper output encoding in include/admin/Tools/Status.php.https://patchthecve.com/cve/CVE-2025-71164.htmlhttps://patchthecve.com/cve/CVE-2025-71164.htmlTue, 14 Jul 2026 23:17:27 +0000MEDIUM 5.4: Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the Editing component. The images parameter (submitted as images[] in a POST request) is reflected into an HTML href attribute without proper context-aware output encoding in include/tool/