https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-50984.htmlhttps://patchthecve.com/cve/CVE-2025-50984.htmlWed, 17 Jun 2026 09:35:29 +0000MEDIUM 5.3: diskover-web v2.3.0 Community Edition is vulnerable to multiple boolean-based blind SQL injection flaws in its Elasticsearch configuration form. Unsanitized user input in POST parameters such as ES_PASS, ES_MAXSIZE, ES_TRANSLOGSIZE, ES_TIMEOUT, ES_USER, ES_HOST, ES_PORT, ES_SCROLLSIZE, ES_CHUNKSIZE https://patchthecve.com/cve/CVE-2025-50986.htmlhttps://patchthecve.com/cve/CVE-2025-50986.htmlWed, 17 Jun 2026 09:35:29 +0000MEDIUM 5.6: diskover-web v2.3.0 Community Edition suffers from multiple stored cross-site scripting (XSS) vulnerabilities in its administrative settings interface. Various configuration fields such as ES_HOST, ES_INDEXREFRESH, ES_PORT, ES_SCROLLSIZE, ES_TRANSLOGSIZE, ES_TRANSLOGSYNCINT, EXCLUDES_FILES, FILE_TYPhttps://patchthecve.com/cve/CVE-2025-50985.htmlhttps://patchthecve.com/cve/CVE-2025-50985.htmlWed, 17 Jun 2026 09:35:29 +0000MEDIUM 5.6: diskover-web v2.3.0 Community Edition is vulnerable to multiple reflected cross-site scripting (XSS) flaws in its web interface. Unsanitized GET parameters including maxage, maxindex, index, path, q (query), and doctype are directly echoed into the HTML response, allowing attackers to inject and exe