https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-25621.htmlhttps://patchthecve.com/cve/CVE-2025-25621.htmlWed, 17 Jun 2026 09:00:57 +0000MEDIUM 4.3: Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows teachers to take attendance of fellow teachers. This affected endpoint is /courses/teacher/index?teacher_id=2&semester_id=1.https://patchthecve.com/cve/CVE-2025-25618.htmlhttps://patchthecve.com/cve/CVE-2025-25618.htmlWed, 17 Jun 2026 09:00:57 +0000LOW 3.3: Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation allowing the change of Section Name and Room Number by Teachers.https://patchthecve.com/cve/CVE-2025-25620.htmlhttps://patchthecve.com/cve/CVE-2025-25620.htmlWed, 17 Jun 2026 09:00:57 +0000MEDIUM 5.4: Unifiedtransform 2.0 is vulnerable to Cross Site Scripting (XSS) in the Create assignment function.https://patchthecve.com/cve/CVE-2025-25614.htmlhttps://patchthecve.com/cve/CVE-2025-25614.htmlWed, 17 Jun 2026 09:00:56 +0000HIGH 8.8: Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation, which allows teachers to update the personal data of fellow teachers.https://patchthecve.com/cve/CVE-2025-25616.htmlhttps://patchthecve.com/cve/CVE-2025-25616.htmlWed, 17 Jun 2026 09:00:57 +0000MEDIUM 4.3: Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows students to modify rules for exams. The affected endpoint is /exams/edit-rule?exam_rule_id=1.https://patchthecve.com/cve/CVE-2025-25615.htmlhttps://patchthecve.com/cve/CVE-2025-25615.htmlWed, 17 Jun 2026 09:00:57 +0000LOW 2.7: Unifiedtransform 2.0 is vulnerable to Incorrect Access Control which allows viewing attendance list for all class sections.https://patchthecve.com/cve/CVE-2024-53573.htmlhttps://patchthecve.com/cve/CVE-2024-53573.htmlWed, 17 Jun 2026 08:09:00 +0000CRITICAL 9.8: Unifiedtransform v2.X is vulnerable to Incorrect Access Control. Unauthorized users can access and manipulate endpoints intended exclusively for administrative use. This issue specifically affects teacher/edit/{id}.