https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2019-16106.htmlhttps://patchthecve.com/cve/CVE-2019-16106.htmlWed, 17 Jun 2026 02:21:41 +0000HIGH 7.5: The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to change the password of any user via the recruitment_online/personalData/act_acounttab.cfm txtNewUserName and hdNP fields.https://patchthecve.com/cve/CVE-2019-15130.htmlhttps://patchthecve.com/cve/CVE-2019-15130.htmlWed, 17 Jun 2026 02:19:45 +0000CRITICAL 9.8: The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to upload any file type to a candidate's profile picture folder via a crafted recruitment_online/personalData/act_personaltab.cfm multiple-part POST request with a predictable WRC01_USERID paramehttps://patchthecve.com/cve/CVE-2019-15129.htmlhttps://patchthecve.com/cve/CVE-2019-15129.htmlWed, 17 Jun 2026 02:19:45 +0000MEDIUM 5.3: The Recruitment module in Humanica Humatrix 7 1.0.0.203 and 1.0.0.681 allows an unauthenticated attacker to access all candidates' files in the photo folder on the website by specifying a "user id" parameter and file name, such as in a recruitment_online/upload/user/[user_id]/photo/[file_name] URI.https://patchthecve.com/cve/CVE-2019-14932.htmlhttps://patchthecve.com/cve/CVE-2019-14932.htmlWed, 17 Jun 2026 02:19:20 +0000HIGH 7.5: The Recruitment module in Humanica Humatrix 7 1.0.0.681 and 1.0.0.203 allows remote attackers to access all candidates' information on the website via a modified selApp variable to personalData/resumeDetail.cfm. This includes personal information and other sensitive data.