https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2007-0054.htmlhttps://patchthecve.com/cve/CVE-2007-0054.htmlTue, 16 Jun 2026 22:34:47 +0000MEDIUM 6.8: Cross-site scripting (XSS) vulnerability in gbrowse.php in Belchior Foundry vCard PRO allows remote attackers to inject arbitrary web script or HTML via the sortby parameter.https://patchthecve.com/cve/CVE-2006-3474.htmlhttps://patchthecve.com/cve/CVE-2006-3474.htmlTue, 16 Jun 2026 22:27:08 +0000HIGH 7.5: Multiple SQL injection vulnerabilities in Belchior Foundry vCard PRO allow remote attackers to execute arbitrary SQL commands via the (1) cat_id parameter to (a) gbrowse.php, (2) card_id parameter to (b) rating.php and (c) create.php, and the (3) event_id parameter to (d) search.php.https://patchthecve.com/cve/CVE-2006-2810.htmlhttps://patchthecve.com/cve/CVE-2006-2810.htmlTue, 16 Jun 2026 22:25:49 +0000MEDIUM 6.8: Multiple cross-site scripting (XSS) vulnerabilities in Belchior Foundry vCard 2.9 allow remote attackers to inject arbitrary web script or HTML via the page parameter in (1) toprated.php and (2) newcards.php. NOTE: the card_id vector is already covered by CVE-2006-1230.https://patchthecve.com/cve/CVE-2006-1230.htmlhttps://patchthecve.com/cve/CVE-2006-1230.htmlTue, 16 Jun 2026 22:22:15 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in create.php in vCard 2.x allow remote attackers to inject arbitrary web script or HTML via the (1) card_id, (2) uploaded, (3) card_fontsize, or (4) card_color parameter. NOTE: the card_id vector was later reported to affect vCard 2.9, and the uphttps://patchthecve.com/cve/CVE-2005-3332.htmlhttps://patchthecve.com/cve/CVE-2005-3332.htmlTue, 16 Jun 2026 22:16:44 +0000HIGH 7.5: PHP remote file include vulnerability in admin/define.inc.php in Belchior Foundry vCard 2.9 allows remote attackers to execute arbitrary PHP code via the match parameter.https://patchthecve.com/cve/CVE-2004-1828.htmlhttps://patchthecve.com/cve/CVE-2004-1828.htmlTue, 16 Jun 2026 22:08:28 +0000MEDIUM 5.0: Vcard 2.9 and possibly other versions does not require authorization to run uninstall.php, which could allow remote attackers to uninstall Vcard and delete database tables via a direct request to uninstall.php.