https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-7357.htmlhttps://patchthecve.com/cve/CVE-2020-7357.htmlWed, 17 Jun 2026 03:24:45 +0000CRITICAL 9.6: Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user through the 'NTP_Server_IP' HTTP POST parameter in system.cgi page. This issue affects several branchhttps://patchthecve.com/cve/CVE-2020-7356.htmlhttps://patchthecve.com/cve/CVE-2020-7356.htmlWed, 17 Jun 2026 03:24:45 +0000CRITICAL 10.0: CAYIN xPost suffers from an unauthenticated SQL Injection vulnerability. Input passed via the GET parameter 'wayfinder_seqid' in wayfinder_meeting_input.jsp is not properly sanitized before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injectinhttps://patchthecve.com/cve/CVE-2020-6955.htmlhttps://patchthecve.com/cve/CVE-2020-6955.htmlWed, 17 Jun 2026 03:24:00 +0000MEDIUM 6.1: An issue was discovered on Cayin SMP-PRO4 devices. They allow image_preview.html?filename= reflected XSS.https://patchthecve.com/cve/CVE-2020-6954.htmlhttps://patchthecve.com/cve/CVE-2020-6954.htmlWed, 17 Jun 2026 03:24:00 +0000MEDIUM 6.5: An issue was discovered on Cayin SMP-PRO4 devices. A user can discover a saved password by viewing the URL after a Connection String Test. This password is shown in the webpass parameter of a media_folder.cgi?apply_mode=ping_server URI.