https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2021-26723.htmlhttps://patchthecve.com/cve/CVE-2021-26723.htmlWed, 17 Jun 2026 03:43:43 +0000MEDIUM 6.1: Jenzabar 9.2.x through 9.2.2 allows /ics?tool=search&query= XSS.https://patchthecve.com/cve/CVE-2020-8434.htmlhttps://patchthecve.com/cve/CVE-2020-8434.htmlWed, 17 Jun 2026 03:26:22 +0000CRITICAL 9.8: Jenzabar JICS (aka Internet Campus Solution) before 9.0.1 Patch 3, 9.1 before 9.1.2 Patch 2, and 9.2 before 9.2.2 Patch 8 has session cookies that are a deterministic function of the username. There is a hard-coded password to supply a PBKDF feeding into AES to encrypt a username and base64 encode ihttps://patchthecve.com/cve/CVE-2019-10012.htmlhttps://patchthecve.com/cve/CVE-2019-10012.htmlWed, 17 Jun 2026 02:10:02 +0000HIGH 7.5: Jenzabar JICS (aka Internet Campus Solution) before 9 allows remote attackers to upload and execute arbitrary .aspx code by placing it in a ZIP archive and using the MoxieManager (for .NET) plugin before 2.1.4 in the moxiemanager directory within the installation folder ICS\ICS.NET\ICSFileServer.https://patchthecve.com/cve/CVE-2019-10011.htmlhttps://patchthecve.com/cve/CVE-2019-10011.htmlWed, 17 Jun 2026 02:10:02 +0000CRITICAL 9.8: ICS/StaticPages/AddTestUsers.aspx in Jenzabar JICS (aka Internet Campus Solution) before 2019-02-06 allows remote attackers to create an arbitrary number of accounts with a password of 1234.https://patchthecve.com/cve/CVE-2018-16778.htmlhttps://patchthecve.com/cve/CVE-2018-16778.htmlWed, 17 Jun 2026 01:44:48 +0000MEDIUM 6.1: Cross-site scripting (XSS) vulnerability in Jenzabar v8.2.1 through 9.2.0 allows remote attackers to inject arbitrary web script or HTML via the query parameter (aka the Search Field).