https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2019-16660.htmlhttps://patchthecve.com/cve/CVE-2019-16660.htmlWed, 17 Jun 2026 02:22:31 +0000HIGH 8.8: joyplus-cms 1.6.0 has admin_ajax.php?action=savexml&tab=vodplay CSRF.https://patchthecve.com/cve/CVE-2019-16656.htmlhttps://patchthecve.com/cve/CVE-2019-16656.htmlWed, 17 Jun 2026 02:22:30 +0000CRITICAL 9.8: joyplus-cms 1.6.0 allows remote attackers to execute arbitrary PHP code via /install by placing the code in the name of an object in the database.https://patchthecve.com/cve/CVE-2019-16655.htmlhttps://patchthecve.com/cve/CVE-2019-16655.htmlWed, 17 Jun 2026 02:22:30 +0000HIGH 7.5: joyplus-cms 1.6.0 allows reinstallation if the install/ URI remains available.https://patchthecve.com/cve/CVE-2018-14501.htmlhttps://patchthecve.com/cve/CVE-2018-14501.htmlWed, 17 Jun 2026 01:41:07 +0000CRITICAL 9.8: manager/admin_ajax.php in joyplus-cms 1.6.0 has SQL Injection, as demonstrated by crafted POST data beginning with an "m_id=1 AND SLEEP(5)" substring.