https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-27183.htmlhttps://patchthecve.com/cve/CVE-2020-27183.htmlWed, 17 Jun 2026 03:08:54 +0000CRITICAL 9.8: A RemoteFunctions endpoint with missing access control in konzept-ix publiXone before 2020.015 allows attackers to disclose sensitive user information, send arbitrary e-mails, escalate the privileges of arbitrary user accounts, and have unspecified other impact.https://patchthecve.com/cve/CVE-2020-27182.htmlhttps://patchthecve.com/cve/CVE-2020-27182.htmlWed, 17 Jun 2026 03:08:54 +0000MEDIUM 6.1: Multiple cross-site scripting (XSS) vulnerabilities in konzept-ix publiXone before 2020.015 allow remote attackers to inject arbitrary JavaScript or HTML via appletError.jsp, job_jacket_detail.jsp, ixedit/editor_component.jsp, or the login form.https://patchthecve.com/cve/CVE-2020-27181.htmlhttps://patchthecve.com/cve/CVE-2020-27181.htmlWed, 17 Jun 2026 03:08:54 +0000MEDIUM 6.5: A hardcoded AES key in CipherUtils.java in the Java applet of konzept-ix publiXone before 2020.015 allows attackers to craft password-reset tokens or decrypt server-side configuration files.https://patchthecve.com/cve/CVE-2020-27180.htmlhttps://patchthecve.com/cve/CVE-2020-27180.htmlWed, 17 Jun 2026 03:08:54 +0000HIGH 7.5: konzept-ix publiXone before 2020.015 allows attackers to download files by iterating over the IXCopy fileID parameter.https://patchthecve.com/cve/CVE-2020-27179.htmlhttps://patchthecve.com/cve/CVE-2020-27179.htmlWed, 17 Jun 2026 03:08:54 +0000CRITICAL 9.8: konzept-ix publiXone before 2020.015 allows attackers to take over arbitrary user accounts by crafting password-reset tokens.