https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-26725.htmlhttps://patchthecve.com/cve/CVE-2026-26725.htmlWed, 17 Jun 2026 10:26:17 +0000CRITICAL 9.8: An issue in edu Business Solutions Print Shop Pro WebDesk v.18.34 (fixed in 19.76) allows a remote attacker to escalate privileges via the AccessID parameter.https://patchthecve.com/cve/CVE-2025-61550.htmlhttps://patchthecve.com/cve/CVE-2025-61550.htmlWed, 17 Jun 2026 09:50:35 +0000MEDIUM 5.4: Cross-Site Scripting (XSS) is present on the ctl00_Content01_fieldValue parameters on the /psp/appNet/TemplateOrder/TemplatePreview.aspx endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.69). User-supplied input is stored and later rendered in HTML pages without prhttps://patchthecve.com/cve/CVE-2025-61549.htmlhttps://patchthecve.com/cve/CVE-2025-61549.htmlWed, 17 Jun 2026 09:50:34 +0000MEDIUM 6.1: Cross-Site Scripting (XSS) is present on the LoginID parameter on the /PSP/app/web/reg/reg_display.asp endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.76). Unsanitized user input is reflected in HTTP responses without proper HTML encoding or escaping. This allowshttps://patchthecve.com/cve/CVE-2025-61548.htmlhttps://patchthecve.com/cve/CVE-2025-61548.htmlWed, 17 Jun 2026 09:50:34 +0000CRITICAL 9.8: SQL Injection is present on the hfInventoryDistFormID parameter in the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.69). Unsanitized user input is incorporated directly into SQL queries without proper parameterizatiohttps://patchthecve.com/cve/CVE-2025-61547.htmlhttps://patchthecve.com/cve/CVE-2025-61547.htmlWed, 17 Jun 2026 09:50:34 +0000MEDIUM 6.8: Cross-Site Request Forgery (CSRF) is present on all functions in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.76). The application does not implement proper CSRF tokens or other other protective measures, allowing a remote attacker to trick authenticated users into unknowhttps://patchthecve.com/cve/CVE-2025-61546.htmlhttps://patchthecve.com/cve/CVE-2025-61546.htmlWed, 17 Jun 2026 09:50:34 +0000CRITICAL 9.1: There is an issue on the /PSP/appNET/Store/CartV12.aspx/GetUnitPrice endpoint in edu Business Solutions Print Shop Pro WebDesk version 18.34 (fixed in 19.69) that enables remote attacker to create financial discrepancies by purchasing items with a negative quantity. This vulnerability is possible du