https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2004-1611.htmlhttps://patchthecve.com/cve/CVE-2004-1611.htmlTue, 16 Jun 2026 22:08:02 +0000MEDIUM 5.1: SalesLogix 6.1 does not verify if a user is authenticated before performing sensitive operations, which could allow remote attackers to (1) execute arbitrary SLX commands on the server or spoof the server via a man-in-the-middle (MITM) attack, or (2) obtain the database password via a GetConnection https://patchthecve.com/cve/CVE-2004-1610.htmlhttps://patchthecve.com/cve/CVE-2004-1610.htmlTue, 16 Jun 2026 22:08:02 +0000HIGH 7.5: SalesLogix 6.1 uses client-specified pathnames for writing certain files, which might allow remote authenticated users to create arbitrary files and execute code via the (1) vMME.AttachmentPath or (2) vMME.LibraryPath variables.https://patchthecve.com/cve/CVE-2004-1609.htmlhttps://patchthecve.com/cve/CVE-2004-1609.htmlTue, 16 Jun 2026 22:08:02 +0000MEDIUM 5.0: SalesLogix 6.1 includes usernames, passwords, and other sensitive information in the headers of an HTTP response, which could allow remote attackers to gain access.https://patchthecve.com/cve/CVE-2004-1608.htmlhttps://patchthecve.com/cve/CVE-2004-1608.htmlTue, 16 Jun 2026 22:08:02 +0000HIGH 7.5: SQL injection vulnerability in SalesLogix 6.1 allows remote attackers to execute arbitrary SQL statements via the id parameter in a view operation.https://patchthecve.com/cve/CVE-2004-1607.htmlhttps://patchthecve.com/cve/CVE-2004-1607.htmlTue, 16 Jun 2026 22:08:02 +0000MEDIUM 5.0: slxweb.dll in SalesLogix 6.1 allows remote attackers to obtain sensitive information via a (1) Library or (2) Attachment request with an invalid file parameter, which reveals the path in an error message.https://patchthecve.com/cve/CVE-2004-1606.htmlhttps://patchthecve.com/cve/CVE-2004-1606.htmlTue, 16 Jun 2026 22:08:02 +0000MEDIUM 6.4: slxweb.dll in SalesLogix 6.1 allows remote attackers to cause a denial service (application crash) via an invalid HTTP request, which might also leak sensitive information in the ErrorLogMsg cookie.https://patchthecve.com/cve/CVE-2004-1605.htmlhttps://patchthecve.com/cve/CVE-2004-1605.htmlTue, 16 Jun 2026 22:08:01 +0000HIGH 7.5: SalesLogix 6.1 allows remote attackers to bypass authentication by modifying the slxweb cookie to set user=Admin, teams=ADMIN!, and usertype=Administrator.