https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-22243.htmlhttps://patchthecve.com/cve/CVE-2026-22243.htmlWed, 17 Jun 2026 10:19:37 +0000HIGH 8.8: EGroupware is a Web based groupware server written in PHP. A SQL Injection vulnerability exists in the core components of EGroupware prior to versions 23.1.20260113 and 26.0.20260113, specifically in the `Nextmatch` filter processing. The flaw allows authenticated attackers to inject arbitrary SQL chttps://patchthecve.com/cve/CVE-2023-38329.htmlhttps://patchthecve.com/cve/CVE-2023-38329.htmlWed, 17 Jun 2026 06:09:55 +0000MEDIUM 6.1: An issue was discovered in eGroupWare 17.1.20190111. A cross-site scripting Reflected (XSS) vulnerability exists in calendar/freebusy.php, which allows unauthenticated remote attackers to inject arbitrary web script or HTML into the "user" HTTP/GET parameter, which reflects its input without sanitizhttps://patchthecve.com/cve/CVE-2023-38327.htmlhttps://patchthecve.com/cve/CVE-2023-38327.htmlWed, 17 Jun 2026 06:09:55 +0000MEDIUM 5.3: An issue was discovered in eGroupWare 17.1.20190111. A User Enumeration vulnerability exists under calendar/freebusy.php, which allows unauthenticated remote attackers to enumerate the users of web applications based on server response.https://patchthecve.com/cve/CVE-2024-40614.htmlhttps://patchthecve.com/cve/CVE-2024-40614.htmlWed, 17 Jun 2026 07:46:10 +0000CRITICAL 9.8: EGroupware before 23.1.20240624 mishandles an ORDER BY clause. This leads to json.php?menuaction=EGroupware\Api\Etemplate\Widget\Nextmatch::ajax_get_rows sort.id SQL injection by authenticated users for Address Book or InfoLog sorting.