PatchTheCVE: jtbchttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2019-9662: An issue was discovered in JTBC(PHP) 3.0.1.8https://patchthecve.com/cve/CVE-2019-9662.htmlhttps://patchthecve.com/cve/CVE-2019-9662.htmlWed, 17 Jun 2026 02:44:09 +0000HIGH 7.5: An issue was discovered in JTBC(PHP) 3.0.1.8. Its cache management module is flawed. An arbitrary file ending in "inc.php" can be deleted via a console/cache/manage.php?type=action&action=batch&batch=delete&ids=../ substring.CVE-2018-17429: /console/account/manage.php?type=action&action=add in JTBC v3.0(C) has CSRF for adding an administrator accounhttps://patchthecve.com/cve/CVE-2018-17429.htmlhttps://patchthecve.com/cve/CVE-2018-17429.htmlWed, 17 Jun 2026 01:45:49 +0000HIGH 8.8: /console/account/manage.php?type=action&action=add in JTBC v3.0(C) has CSRF for adding an administrator account.CVE-2019-8433: JTBC(PHP) 3.0.1.8 allows Arbitrary File Upload via the console/#/console/file/manage.php?type=list URI, as demhttps://patchthecve.com/cve/CVE-2019-8433.htmlhttps://patchthecve.com/cve/CVE-2019-8433.htmlWed, 17 Jun 2026 02:41:59 +0000HIGH 7.5: JTBC(PHP) 3.0.1.8 allows Arbitrary File Upload via the console/#/console/file/manage.php?type=list URI, as demonstrated by a .php file.CVE-2018-19547: JTBC(PHP) 3.0.1.7 has XSS via the console/xml/manage.php?type=action&action=edit content parameter.https://patchthecve.com/cve/CVE-2018-19547.htmlhttps://patchthecve.com/cve/CVE-2018-19547.htmlWed, 17 Jun 2026 01:49:28 +0000MEDIUM 6.1: JTBC(PHP) 3.0.1.7 has XSS via the console/xml/manage.php?type=action&action=edit content parameter.CVE-2018-19546: JTBC(PHP) 3.0.1.7 has CSRF via the console/xml/manage.php?type=action&action=edit URI, as demonstrated by an Xhttps://patchthecve.com/cve/CVE-2018-19546.htmlhttps://patchthecve.com/cve/CVE-2018-19546.htmlWed, 17 Jun 2026 01:49:28 +0000HIGH 8.8: JTBC(PHP) 3.0.1.7 has CSRF via the console/xml/manage.php?type=action&action=edit URI, as demonstrated by an XSS payload in the content parameter.CVE-2018-19327: An issue was discovered in JTBC(PHP) 3.0.1.7https://patchthecve.com/cve/CVE-2018-19327.htmlhttps://patchthecve.com/cve/CVE-2018-19327.htmlWed, 17 Jun 2026 01:49:08 +0000HIGH 8.8: An issue was discovered in JTBC(PHP) 3.0.1.7. aboutus/manage.php?type=action&action=add allows CSRF.CVE-2018-18436: JTBC(PHP) 3.0 allows CSRF for creating an account via the console/account/manage.php?type=action&action=add URhttps://patchthecve.com/cve/CVE-2018-18436.htmlhttps://patchthecve.com/cve/CVE-2018-18436.htmlWed, 17 Jun 2026 01:47:17 +0000HIGH 8.8: JTBC(PHP) 3.0 allows CSRF for creating an account via the console/account/manage.php?type=action&action=add URI.CVE-2018-17838: An issue was discovered in JTBC(PHP) 3.0.1.6https://patchthecve.com/cve/CVE-2018-17838.htmlhttps://patchthecve.com/cve/CVE-2018-17838.htmlWed, 17 Jun 2026 01:46:22 +0000HIGH 7.5: An issue was discovered in JTBC(PHP) 3.0.1.6. Arbitrary file read operations are possible via a /console/#/console/file/manage.php?type=list&path=c:/ substring.CVE-2018-17837: An issue was discovered in JTBC(PHP) 3.0.1.6https://patchthecve.com/cve/CVE-2018-17837.htmlhttps://patchthecve.com/cve/CVE-2018-17837.htmlWed, 17 Jun 2026 01:46:22 +0000HIGH 7.5: An issue was discovered in JTBC(PHP) 3.0.1.6. Arbitrary file deletion is possible via a /console/file/manage.php?type=action&action=delete&path=c%3A%2F substring.CVE-2018-17836: An issue was discovered in JTBC(PHP) 3.0.1.6https://patchthecve.com/cve/CVE-2018-17836.htmlhttps://patchthecve.com/cve/CVE-2018-17836.htmlWed, 17 Jun 2026 01:46:22 +0000HIGH 8.8: An issue was discovered in JTBC(PHP) 3.0.1.6. It allows remote attackers to execute arbitrary PHP code by using a /console/file/manage.php?type=action&action=addfile&path=..%2F substring to upload, in conjunction with a multipart/form-data PHP payload.