https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-48341.htmlhttps://patchthecve.com/cve/CVE-2024-48341.htmlWed, 17 Jun 2026 07:58:25 +0000LOW 3.7: dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=addShophttps://patchthecve.com/cve/CVE-2025-28100.htmlhttps://patchthecve.com/cve/CVE-2025-28100.htmlWed, 17 Jun 2026 09:04:34 +0000CRITICAL 9.8: A SQL Injection vulnerability in dingfanzuCMS v.1.0 allows a attacker to execute arbitrary code via not filtering the content correctly at the "operateOrder.php" id parameter.https://patchthecve.com/cve/CVE-2024-50652.htmlhttps://patchthecve.com/cve/CVE-2024-50652.htmlWed, 17 Jun 2026 08:04:52 +0000MEDIUM 4.3: A file upload vulnerability in java_shop 1.0 allows attackers to upload arbitrary files by modifying the avatar function.https://patchthecve.com/cve/CVE-2024-50651.htmlhttps://patchthecve.com/cve/CVE-2024-50651.htmlWed, 17 Jun 2026 08:04:52 +0000MEDIUM 6.5: java_shop 1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different IDs by modifying the ID parameter.https://patchthecve.com/cve/CVE-2024-8302.htmlhttps://patchthecve.com/cve/CVE-2024-8302.htmlWed, 17 Jun 2026 08:22:19 +0000MEDIUM 6.3: A vulnerability was found in dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c. It has been rated as critical. Affected by this issue is some unknown functionality of the file /ajax/chpwd.php. The manipulation of the argument username leads to sql injection. The attack may be launched rem