https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-63314.htmlhttps://patchthecve.com/cve/CVE-2025-63314.htmlSun, 05 Jul 2026 17:17:21 +0000CRITICAL 10.0: A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to arbitrarily reset the user password and execute a full account takeover via a replay attack.https://patchthecve.com/cve/CVE-2025-25967.htmlhttps://patchthecve.com/cve/CVE-2025-25967.htmlWed, 17 Jun 2026 09:01:21 +0000HIGH 8.8: Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery (CSRF). This flaw enables attackers to trick authenticated users into performing unauthorized actions, such as account deletion or user creation, by embedding malicious requests in external content. The lack of CSRF protections allhttps://patchthecve.com/cve/CVE-2025-25968.htmlhttps://patchthecve.com/cve/CVE-2025-25968.htmlSun, 05 Jul 2026 01:21:37 +0000MEDIUM 6.0: DDSN Interactive cm3 Acora CMS version 10.1.1 contains an improper access control vulnerability. An editor-privileged user can access sensitive information, such as system administrator credentials, by force browsing the endpoint and exploiting the 'file' parameter. By referencing specific files (e.https://patchthecve.com/cve/CVE-2025-22964.htmlhttps://patchthecve.com/cve/CVE-2025-22964.htmlWed, 17 Jun 2026 08:51:14 +0000HIGH 8.1: DDSN Interactive cm3 Acora CMS version 10.1.1 has an unauthenticated time-based blind SQL Injection vulnerability caused by insufficient input sanitization and validation in the "table" parameter. This flaw allows attackers to inject malicious SQL queries by directly incorporating user-supplied inpu