https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-7103.htmlhttps://patchthecve.com/cve/CVE-2025-7103.htmlWed, 17 Jun 2026 10:04:16 +0000MEDIUM 6.3: A vulnerability was found in BoyunCMS up to 1.4.20. It has been rated as critical. This issue affects some unknown processing of the file /application/pay/controller/Index.php of the component curl. The manipulation leads to server-side request forgery. The attack may be initiated remotely. The explhttps://patchthecve.com/cve/CVE-2025-7102.htmlhttps://patchthecve.com/cve/CVE-2025-7102.htmlWed, 17 Jun 2026 10:04:16 +0000MEDIUM 6.3: A vulnerability was found in BoyunCMS up to 1.4.20. It has been declared as critical. This vulnerability affects unknown code of the file application/update/controller/Server.php. The manipulation of the argument phone leads to sql injection. The attack can be initiated remotely. The exploit has beehttps://patchthecve.com/cve/CVE-2025-7101.htmlhttps://patchthecve.com/cve/CVE-2025-7101.htmlWed, 17 Jun 2026 10:04:16 +0000MEDIUM 6.3: A vulnerability was found in BoyunCMS up to 1.4.20. It has been classified as critical. This affects an unknown part of the file /install/install_ok.php of the component Configuration File Handler. The manipulation of the argument db_pass leads to code injection. It is possible to initiate the attachttps://patchthecve.com/cve/CVE-2025-7100.htmlhttps://patchthecve.com/cve/CVE-2025-7100.htmlWed, 17 Jun 2026 10:04:16 +0000MEDIUM 6.3: A vulnerability was found in BoyunCMS up to 1.4.20 and classified as critical. Affected by this issue is some unknown functionality of the file /application/user/controller/Index.php. The manipulation of the argument image leads to unrestricted upload. The attack may be launched remotely. The exploihttps://patchthecve.com/cve/CVE-2025-7099.htmlhttps://patchthecve.com/cve/CVE-2025-7099.htmlWed, 17 Jun 2026 10:04:15 +0000MEDIUM 5.6: A vulnerability has been found in BoyunCMS up to 1.21 on PHP7 and classified as critical. Affected by this vulnerability is an unknown functionality of the file install/install2.php of the component Installation Handler. The manipulation of the argument db_host leads to deserialization. The attack c