https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2019-16531.htmlhttps://patchthecve.com/cve/CVE-2019-16531.htmlWed, 17 Jun 2026 02:22:22 +0000HIGH 8.8: LayerBB before 1.1.4 has multiple CSRF issues, as demonstrated by changing the System Settings via admin/general.php.https://patchthecve.com/cve/CVE-2019-13974.htmlhttps://patchthecve.com/cve/CVE-2019-13974.htmlWed, 17 Jun 2026 02:17:32 +0000HIGH 8.8: LayerBB 1.1.3 allows conversations.php/cmd/new CSRF.https://patchthecve.com/cve/CVE-2019-13973.htmlhttps://patchthecve.com/cve/CVE-2019-13973.htmlWed, 17 Jun 2026 02:17:32 +0000CRITICAL 9.8: LayerBB 1.1.3 allows admin/general.php arbitrary file upload because the custom_logo filename suffix is not restricted, and .php may be used.https://patchthecve.com/cve/CVE-2019-13972.htmlhttps://patchthecve.com/cve/CVE-2019-13972.htmlWed, 17 Jun 2026 02:17:32 +0000MEDIUM 6.1: LayerBB 1.1.3 allows XSS via the application/commands/new.php pm_title variable, a related issue to CVE-2019-17997.https://patchthecve.com/cve/CVE-2018-17997.htmlhttps://patchthecve.com/cve/CVE-2018-17997.htmlWed, 17 Jun 2026 01:46:39 +0000MEDIUM 6.1: LayerBB 1.1.1 allows XSS via the titles of conversations (PMs).https://patchthecve.com/cve/CVE-2018-17996.htmlhttps://patchthecve.com/cve/CVE-2018-17996.htmlWed, 17 Jun 2026 01:46:39 +0000MEDIUM 6.5: LayerBB before 1.1.3 allows CSRF for adding a user via admin/new_user.php, deleting a user via admin/members.php/delete_user/, and deleting content via mod/delete.php/.https://patchthecve.com/cve/CVE-2018-17988.htmlhttps://patchthecve.com/cve/CVE-2018-17988.htmlWed, 17 Jun 2026 01:46:39 +0000CRITICAL 9.8: LayerBB 1.1.1 and 1.1.3 has SQL Injection via the search.php search_query parameter.