https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2019-18872.htmlhttps://patchthecve.com/cve/CVE-2019-18872.htmlWed, 17 Jun 2026 02:25:30 +0000HIGH 7.5: Weak password requirements in Blaauw Remote Kiln Control through v3.00r4 allow a user to set short or guessable passwords (e.g., 1 or 1234).https://patchthecve.com/cve/CVE-2019-18871.htmlhttps://patchthecve.com/cve/CVE-2019-18871.htmlWed, 17 Jun 2026 02:25:30 +0000HIGH 8.8: A path traversal in debug.php accessed via default.php in Blaauw Remote Kiln Control through v3.00r4 allows an authenticated attacker to upload arbitrary files, leading to arbitrary remote code execution.https://patchthecve.com/cve/CVE-2019-18870.htmlhttps://patchthecve.com/cve/CVE-2019-18870.htmlWed, 17 Jun 2026 02:25:30 +0000MEDIUM 6.5: A path traversal via the iniFile parameter in excel.php in Blaauw Remote Kiln Control through v3.00r4 allows an authenticated attacker to download arbitrary files from the host machine.https://patchthecve.com/cve/CVE-2019-18869.htmlhttps://patchthecve.com/cve/CVE-2019-18869.htmlWed, 17 Jun 2026 02:25:30 +0000CRITICAL 9.8: Leftover Debug Code in Blaauw Remote Kiln Control through v3.00r4 allows a user to execute arbitrary php code via /default.php?idx=17.https://patchthecve.com/cve/CVE-2019-18866.htmlhttps://patchthecve.com/cve/CVE-2019-18866.htmlWed, 17 Jun 2026 02:25:29 +0000HIGH 7.5: Unauthenticated SQL injection via the username in the login mechanism in Blaauw Remote Kiln Control through v3.00r4 allows a user to extract arbitrary data from the rkc database.https://patchthecve.com/cve/CVE-2019-18864.htmlhttps://patchthecve.com/cve/CVE-2019-18864.htmlWed, 17 Jun 2026 02:25:29 +0000HIGH 7.5: /server-info and /server-status in Blaauw Remote Kiln Control through v3.00r4 allow an unauthenticated attacker to gain sensitive information about the host machine.https://patchthecve.com/cve/CVE-2019-18868.htmlhttps://patchthecve.com/cve/CVE-2019-18868.htmlWed, 17 Jun 2026 02:25:30 +0000CRITICAL 9.8: Blaauw Remote Kiln Control through v3.00r4 allows an unauthenticated attacker to access MySQL credentials in cleartext in /engine/db.inc, /lang/nl.bak, or /lang/en.bak.https://patchthecve.com/cve/CVE-2019-18867.htmlhttps://patchthecve.com/cve/CVE-2019-18867.htmlWed, 17 Jun 2026 02:25:30 +0000HIGH 7.5: Browsable directories in Blaauw Remote Kiln Control through v3.00r4 allow an attacker to enumerate sensitive filenames and locations, including source code. This affects /ajax/, /common/, /engine/, /flash/, /images/, /Images/, /jscripts/, /lang/, /layout/, /programs/, and /sms/.https://patchthecve.com/cve/CVE-2019-18865.htmlhttps://patchthecve.com/cve/CVE-2019-18865.htmlWed, 17 Jun 2026 02:25:29 +0000MEDIUM 5.3: Information disclosure via error message discrepancies in authentication functions in Blaauw Remote Kiln Control through v3.00r4 allows an unauthenticated attacker to enumerate valid usernames.