https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2012-4977.htmlhttps://patchthecve.com/cve/CVE-2012-4977.htmlTue, 16 Jun 2026 23:45:59 +0000MEDIUM 5.0: Layton Helpbox 4.4.0 allows remote attackers to discover cleartext credentials for the login page by sniffing the network.https://patchthecve.com/cve/CVE-2012-4976.htmlhttps://patchthecve.com/cve/CVE-2012-4976.htmlTue, 16 Jun 2026 23:45:59 +0000MEDIUM 5.0: selectawasset.asp in Layton Helpbox 4.4.0 allows remote attackers to discover ODBC database credentials via an element=sys_asset_id request, which is not properly handled during construction of an error page.https://patchthecve.com/cve/CVE-2012-4975.htmlhttps://patchthecve.com/cve/CVE-2012-4975.htmlTue, 16 Jun 2026 23:45:59 +0000MEDIUM 4.0: editrequestuser.asp in Layton Helpbox 4.4.0 allows remote authenticated users to change arbitrary support-ticket data via a modified sys_request_id parameter.https://patchthecve.com/cve/CVE-2012-4972.htmlhttps://patchthecve.com/cve/CVE-2012-4972.htmlTue, 16 Jun 2026 23:45:59 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in Layton Helpbox 4.4.0 allow remote attackers to inject arbitrary web script or HTML via the (1) sys_solution_id, (2) sys_requesttype_id, (3) sys_problem_desc, (4) sys_solution_desc, (5) sys_problemsummary, (6) usr_Action_testing, (7) usr_Escalatihttps://patchthecve.com/cve/CVE-2012-4971.htmlhttps://patchthecve.com/cve/CVE-2012-4971.htmlTue, 16 Jun 2026 23:45:59 +0000HIGH 7.5: Multiple SQL injection vulnerabilities in Layton Helpbox 4.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) reqclass parameter to editrequestenduser.asp; the (2) sys_request_id parameter to editrequestuser.asp; the (3) sys_request_id parameter to enduseractions.asp; the (4) s