https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2015-9227.htmlhttps://patchthecve.com/cve/CVE-2015-9227.htmlWed, 17 Jun 2026 00:36:05 +0000HIGH 7.2: PHP remote file inclusion vulnerability in the get_file function in upload/admin2/controller/report_logs.php in AlegroCart 1.2.8 allows remote administrators to execute arbitrary PHP code via a URL in the file_path parameter to upload/admin2.https://patchthecve.com/cve/CVE-2015-9226.htmlhttps://patchthecve.com/cve/CVE-2015-9226.htmlWed, 17 Jun 2026 00:36:05 +0000HIGH 7.2: Multiple SQL injection vulnerabilities in AlegroCart 1.2.8 allow remote administrators to execute arbitrary SQL commands via the download parameter in the (1) check_download and possibly (2) check_filename function in upload/admin2/model/products/model_admin_download.php or remote authenticated userhttps://patchthecve.com/cve/CVE-2011-3701.htmlhttps://patchthecve.com/cve/CVE-2011-3701.htmlTue, 16 Jun 2026 23:33:46 +0000MEDIUM 5.0: AlegroCart 1.2.3 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by common.php and certain other files.