https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-37162.htmlhttps://patchthecve.com/cve/CVE-2022-37162.htmlWed, 17 Jun 2026 04:54:41 +0000MEDIUM 5.4: Claroline 13.5.7 and prior is vulnerable to Cross Site Scripting (XSS). An attacker can obtain javascript code execution by adding arbitrary javascript code in the 'Location' field of a calendar event.https://patchthecve.com/cve/CVE-2022-37161.htmlhttps://patchthecve.com/cve/CVE-2022-37161.htmlWed, 17 Jun 2026 04:54:40 +0000MEDIUM 6.1: Claroline 13.5.7 and prior is vulnerable to Cross Site Scripting (XSS) via SVG file upload.https://patchthecve.com/cve/CVE-2022-37160.htmlhttps://patchthecve.com/cve/CVE-2022-37160.htmlWed, 17 Jun 2026 04:54:40 +0000MEDIUM 5.4: Claroline 13.5.7 and prior allows an authenticated attacker to elevate privileges via the arbitrary creation of a privileged user. By combining the XSS vulnerability present in several upload forms and a javascript request to the present API, it is possible to trigger the creation of a user with admhttps://patchthecve.com/cve/CVE-2022-37159.htmlhttps://patchthecve.com/cve/CVE-2022-37159.htmlWed, 17 Jun 2026 04:54:40 +0000CRITICAL 9.8: Claroline 13.5.7 and prior is vulnerable to Remote code execution via arbitrary file upload.