https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-18327.htmlhttps://patchthecve.com/cve/CVE-2020-18327.htmlWed, 17 Jun 2026 02:59:16 +0000MEDIUM 6.1: Cross Site Scripting (XSS) vulnerability exists in Alfresco Alfresco Community Edition v5.2.0 via the action parameter in the alfresco/s/admin/admin-nodebrowser API. Fixed in v6.2https://patchthecve.com/cve/CVE-2021-41792.htmlhttps://patchthecve.com/cve/CVE-2021-41792.htmlWed, 17 Jun 2026 04:08:55 +0000MEDIUM 5.3: An issue was discovered in Hyland org.alfresco:alfresco-content-services through 6.2.2.18 and org.alfresco:alfresco-transform-services through 1.3. A crafted HTML file, once uploaded, could trigger an unexpected request by the transformation engine. The response to the request is not available to thhttps://patchthecve.com/cve/CVE-2021-41791.htmlhttps://patchthecve.com/cve/CVE-2021-41791.htmlWed, 17 Jun 2026 04:08:55 +0000MEDIUM 5.4: An issue was discovered in Hyland org.alfresco:share through 7.0.0.2 and org.alfresco:community-share through 7.0. An evasion of the XSS filter for HTML input validation in the Alfresco Share User Interface leads to stored XSS that could be exploited by an attacker (given that he has privileges on thttps://patchthecve.com/cve/CVE-2021-41790.htmlhttps://patchthecve.com/cve/CVE-2021-41790.htmlWed, 17 Jun 2026 04:08:55 +0000HIGH 8.8: An issue was discovered in Hyland org.alfresco:alfresco-content-services through 7.0.1.2. Script Action execution allows executing scripts uploaded outside of the Data Dictionary. This could allow a logged-in attacker to execute arbitrary code inside a sandboxed environment.https://patchthecve.com/cve/CVE-2020-15181.htmlhttps://patchthecve.com/cve/CVE-2020-15181.htmlWed, 17 Jun 2026 02:56:12 +0000CRITICAL 9.3: The Alfresco Reset Password add-on before version 1.2.0 relies on untrusted inputs in a security decision. Intruders can get admin's access to the system using the vulnerability in the project. Impacts all servers where this add-on is installed. The problem is fixed in version 1.2.0https://patchthecve.com/cve/CVE-2020-25728.htmlhttps://patchthecve.com/cve/CVE-2020-25728.htmlWed, 17 Jun 2026 03:07:12 +0000HIGH 8.8: The Reset Password add-on before 1.2.0 for Alfresco has a broken algorithm (involving an increment) that allows a malicious user to change any user's account password include the admin account.