https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-33291.htmlhttps://patchthecve.com/cve/CVE-2023-33291.htmlWed, 17 Jun 2026 06:01:30 +0000HIGH 7.4: In ebankIT 6, the public endpoints /public/token/Email/generate and /public/token/SMS/generate allow generation of OTP messages to any e-mail address or phone number without validation. (It cannot be exploited with e-mail addresses or phone numbers that are registered in the application.)https://patchthecve.com/cve/CVE-2023-30454.htmlhttps://patchthecve.com/cve/CVE-2023-30454.htmlWed, 17 Jun 2026 05:54:44 +0000MEDIUM 6.1: An issue was discovered in ebankIT before 7. Document Object Model based XSS exists within the /Security/Transactions/Transactions.aspx endpoint. Users can supply their own JavaScript within the ctl100$ctl00MainContent$TransactionMainContent$accControl$hdnAccountsArray POST parameter that will be pahttps://patchthecve.com/cve/CVE-2023-30455.htmlhttps://patchthecve.com/cve/CVE-2023-30455.htmlWed, 17 Jun 2026 05:54:45 +0000HIGH 7.5: An issue was discovered in ebankIT before 7. A Denial-of-Service attack is possible through the GET parameter EStatementsIds located on the /Controls/Generic/EBMK/Handlers/EStatements/DownloadEStatement.ashx endpoint. The GET parameter accepts over 100 comma-separated e-statement IDs without throwin