https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-25912.htmlhttps://patchthecve.com/cve/CVE-2020-25912.htmlThu, 09 Jul 2026 00:17:02 +0000CRITICAL 9.1: A XML External Entity (XXE) vulnerability was discovered in symphony\lib\toolkit\class.xmlelement.php in Symphony 2.7.10 which can lead to an information disclosure or denial of service (DOS).https://patchthecve.com/cve/CVE-2020-25343.htmlhttps://patchthecve.com/cve/CVE-2020-25343.htmlWed, 17 Jun 2026 03:06:44 +0000MEDIUM 5.4: Cross-site scripting (XSS) vulnerabilities in Symphony CMS 3.0.0 allow remote attackers to inject arbitrary web script or HTML to fields['body'] param via events\event.publish_article.phphttps://patchthecve.com/cve/CVE-2020-15071.htmlhttps://patchthecve.com/cve/CVE-2020-15071.htmlWed, 17 Jun 2026 02:56:00 +0000MEDIUM 6.1: content/content.blueprintsevents.php in Symphony CMS 3.0.0 allows XSS via fields['name'] to appendSubheading.https://patchthecve.com/cve/CVE-2018-12043.htmlhttps://patchthecve.com/cve/CVE-2018-12043.htmlWed, 17 Jun 2026 01:37:03 +0000MEDIUM 6.1: content/content.blueprintspages.php in Symphony 2.7.6 has XSS via the pages content page.https://patchthecve.com/cve/CVE-2017-8876.htmlhttps://patchthecve.com/cve/CVE-2017-8876.htmlWed, 17 Jun 2026 01:27:07 +0000MEDIUM 6.1: Symphony 2 2.6.11 has XSS in the meta[navigation_group] parameter to content/content.blueprintssections.php.https://patchthecve.com/cve/CVE-2017-7694.htmlhttps://patchthecve.com/cve/CVE-2017-7694.htmlWed, 17 Jun 2026 01:25:00 +0000HIGH 8.8: Remote Code Execution vulnerability in symphony/content/content.blueprintsdatasources.php in Symphony CMS through 2.6.11 allows remote attackers to execute code and get a webshell from the back-end. The attacker must be authenticated and enter PHP code in the datasource editor or event editor.https://patchthecve.com/cve/CVE-2017-6067.htmlhttps://patchthecve.com/cve/CVE-2017-6067.htmlWed, 17 Jun 2026 01:21:44 +0000MEDIUM 6.1: Symphony 2.6.9 has XSS in publish/notes/edit/##/saved/ via the bottom form field.https://patchthecve.com/cve/CVE-2017-5542.htmlhttps://patchthecve.com/cve/CVE-2017-5542.htmlWed, 17 Jun 2026 01:20:42 +0000MEDIUM 6.1: Cross-site scripting (XSS) vulnerability in template/usererror.missing_extension.php in Symphony CMS before 2.6.10 allows remote attackers to inject arbitrary web script or HTML via the existing-folder parameter.https://patchthecve.com/cve/CVE-2017-5541.htmlhttps://patchthecve.com/cve/CVE-2017-5541.htmlWed, 17 Jun 2026 01:20:42 +0000MEDIUM 5.3: Directory traversal vulnerability in template/usererror.missing_extension.php in Symphony CMS before 2.6.10 allows remote attackers to rename arbitrary files via a .. (dot dot) in the existing-folder and new-folder parameters.