https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2010-2859.htmlhttps://patchthecve.com/cve/CVE-2010-2859.htmlTue, 16 Jun 2026 23:21:38 +0000MEDIUM 5.0: news.php in SimpNews 2.47.3 and earlier allows remote attackers to obtain sensitive information via an invalid lang parameter, which reveals the installation path in an error message.https://patchthecve.com/cve/CVE-2010-2858.htmlhttps://patchthecve.com/cve/CVE-2010-2858.htmlTue, 16 Jun 2026 23:21:38 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in news.php in SimpNews 2.47.03 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) layout and (2) sortorder parameters.https://patchthecve.com/cve/CVE-2010-1360.htmlhttps://patchthecve.com/cve/CVE-2010-1360.htmlTue, 16 Jun 2026 23:18:12 +0000HIGH 7.5: Multiple PHP remote file inclusion vulnerabilities in FAQEngine 4.24.00 allow remote attackers to execute arbitrary PHP code via a URL in the path_faqe parameter to (1) attachs.php, (2) backup.php, (3) badwords.php, (4) categories.php, (5) changepw.php, (6) colorchooser.php, (7) colorwheel.php, (8) https://patchthecve.com/cve/CVE-2007-5130.htmlhttps://patchthecve.com/cve/CVE-2007-5130.htmlTue, 16 Jun 2026 22:45:30 +0000MEDIUM 4.3: SimpGB 1.46.02 allows remote attackers to obtain sensitive information via (1) an invalid lang parameter to admin/index.php or (2) a direct request to admin/trailer.php, which reveals the path in various error messages.https://patchthecve.com/cve/CVE-2007-5129.htmlhttps://patchthecve.com/cve/CVE-2007-5129.htmlTue, 16 Jun 2026 22:45:29 +0000MEDIUM 5.0: SimpGB 1.46.02 stores sensitive information under the web root with insufficient access control, which allows remote attackers to (1) obtain sensitive configuration information via a direct request for admin/cfginfo.php; and (2) download arbitrary .inc files via a direct request, as demonstrated by https://patchthecve.com/cve/CVE-2007-5128.htmlhttps://patchthecve.com/cve/CVE-2007-5128.htmlTue, 16 Jun 2026 22:45:29 +0000MEDIUM 5.0: SimpNews 2.41.03 on Windows, when PHP before 5.0.0 is used, allows remote attackers to obtain sensitive information via an certain link_date parameter to events.php, which reveals the path in an error message due to an unsupported argument type for the mktime function on Windows.https://patchthecve.com/cve/CVE-2007-4874.htmlhttps://patchthecve.com/cve/CVE-2007-4874.htmlTue, 16 Jun 2026 22:44:55 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in SimpNews 2.41.03 allow remote attackers to inject arbitrary web script or HTML via the (1) l_username parameter to admin/layout2b.php, and the (2) backurl parameter to comment.php.