https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-18477.htmlhttps://patchthecve.com/cve/CVE-2020-18477.htmlWed, 17 Jun 2026 02:59:21 +0000HIGH 8.8: SQL Injection vulnerability in Hucart CMS 5.7.4 via the purchase enquiry field found in the Message con_content field.https://patchthecve.com/cve/CVE-2020-18476.htmlhttps://patchthecve.com/cve/CVE-2020-18476.htmlWed, 17 Jun 2026 02:59:21 +0000HIGH 8.8: SQL Injection vulnerability in Hucart CMS 5.7.4 via the basic information field found in the avatar usd_image field.https://patchthecve.com/cve/CVE-2020-18475.htmlhttps://patchthecve.com/cve/CVE-2020-18475.htmlWed, 17 Jun 2026 02:59:21 +0000MEDIUM 5.4: Cross Site Scripting (XSS) vulnerabilty exists in Hucart CMS 5.7.4 is via the mes_title field. The first user inserts a malicious script into the header field of the outbox and sends it to other users. When other users open the email, the malicious code will be executed.https://patchthecve.com/cve/CVE-2020-18158.htmlhttps://patchthecve.com/cve/CVE-2020-18158.htmlWed, 17 Jun 2026 02:59:11 +0000MEDIUM 5.4: Cross Site Scripting (XSS) vulnerability in HuCart 5.7.4 via nickname in index.php.