https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-23763.htmlhttps://patchthecve.com/cve/CVE-2024-23763.htmlWed, 17 Jun 2026 07:13:33 +0000CRITICAL 9.8: SQL Injection vulnerability in Gambio through 4.9.2.0 allows attackers to run arbitrary SQL commands via crafted GET request using modifiers[attribute][] parameter.https://patchthecve.com/cve/CVE-2024-23762.htmlhttps://patchthecve.com/cve/CVE-2024-23762.htmlWed, 17 Jun 2026 07:13:32 +0000HIGH 7.8: Unrestricted File Upload vulnerability in Content Manager feature in Gambio 4.9.2.0 allows attackers to execute arbitrary code via upload of crafted PHP file.https://patchthecve.com/cve/CVE-2024-23761.htmlhttps://patchthecve.com/cve/CVE-2024-23761.htmlWed, 17 Jun 2026 07:13:32 +0000CRITICAL 9.8: Server Side Template Injection in Gambio 4.9.2.0 allows attackers to run arbitrary code via crafted smarty email template.https://patchthecve.com/cve/CVE-2024-23760.htmlhttps://patchthecve.com/cve/CVE-2024-23760.htmlWed, 17 Jun 2026 07:13:32 +0000LOW 2.7: Cleartext Storage of Sensitive Information in Gambio 4.9.2.0 allows attackers to obtain sensitive information via error-handler.log.json and legacy-error-handler.log.txt under the webroot.https://patchthecve.com/cve/CVE-2024-23759.htmlhttps://patchthecve.com/cve/CVE-2024-23759.htmlWed, 17 Jun 2026 07:13:32 +0000CRITICAL 9.8: Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopfinder/AddAddressBookEntry" function.