https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-5558.htmlhttps://patchthecve.com/cve/CVE-2020-5558.htmlWed, 17 Jun 2026 03:21:36 +0000HIGH 8.8: CuteNews 2.0.1 allows remote authenticated attackers to execute arbitrary PHP code via unspecified vectors.https://patchthecve.com/cve/CVE-2020-5557.htmlhttps://patchthecve.com/cve/CVE-2020-5557.htmlWed, 17 Jun 2026 03:21:35 +0000MEDIUM 6.1: Cross-site scripting vulnerability in CuteNews 2.0.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.https://patchthecve.com/cve/CVE-2019-11447.htmlhttps://patchthecve.com/cve/CVE-2019-11447.htmlWed, 17 Jun 2026 02:12:54 +0000HIGH 8.8: An issue was discovered in CutePHP CuteNews 2.1.2. An attacker can infiltrate the server through the avatar upload process in the profile area via the avatar_file field to index.php?mod=main&opt=personal. There is no effective control of $imgsize in /core/modules/dashboard.php. The header content of