https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2018-14729.htmlhttps://patchthecve.com/cve/CVE-2018-14729.htmlWed, 17 Jun 2026 01:41:31 +0000HIGH 8.8: The database backup feature in upload/source/admincp/admincp_db.php in Discuz! 2.5 and 3.4 allows remote attackers to execute arbitrary PHP code.https://patchthecve.com/cve/CVE-2018-20424.htmlhttps://patchthecve.com/cve/CVE-2018-20424.htmlWed, 17 Jun 2026 01:52:48 +0000MEDIUM 5.9: Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to delete the common_member_wechatmp data structure via an ac=unbindmp request to plugin.php.https://patchthecve.com/cve/CVE-2018-20423.htmlhttps://patchthecve.com/cve/CVE-2018-20423.htmlWed, 17 Jun 2026 01:52:48 +0000HIGH 8.1: Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to bypass a "disabled registration" setting by adding a non-existing wxopenid value to the plugin.php ac=wxregister query string.https://patchthecve.com/cve/CVE-2018-20422.htmlhttps://patchthecve.com/cve/CVE-2018-20422.htmlWed, 17 Jun 2026 01:52:48 +0000HIGH 8.1: Discuz! DiscuzX 3.4, when WeChat login is enabled, allows remote attackers to bypass authentication by leveraging a non-empty #wechat#common_member_wechatmp to gain login access to an account via a plugin.php ac=wxregister request (the attacker does not have control over which account will be accesshttps://patchthecve.com/cve/CVE-2018-18084.htmlhttps://patchthecve.com/cve/CVE-2018-18084.htmlWed, 17 Jun 2026 01:46:45 +0000CRITICAL 9.8: An issue was discovered in DuomiCMS 3.0. SQL injection exists in the ajax.php file, as demonstrated by the uid parameter.https://patchthecve.com/cve/CVE-2018-18083.htmlhttps://patchthecve.com/cve/CVE-2018-18083.htmlWed, 17 Jun 2026 01:46:45 +0000CRITICAL 9.8: An issue was discovered in DuomiCMS 3.0. Remote PHP code execution is possible via the search.php searchword parameter because "eval" is used during "if" processing.