https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-13994.htmlhttps://patchthecve.com/cve/CVE-2020-13994.htmlWed, 17 Jun 2026 02:54:03 +0000HIGH 8.8: An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A privileged user can achieve code execution on the server via a ticket because of improper access control of uploaded resources. This might be exploitable in conjunction with CVE-2020-13992 by an unauthenticated attacker.https://patchthecve.com/cve/CVE-2020-13993.htmlhttps://patchthecve.com/cve/CVE-2020-13993.htmlWed, 17 Jun 2026 02:54:03 +0000HIGH 7.5: An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A blind time-based SQL injection issue allows remote unauthenticated attackers to retrieve information from the database via a ticket.https://patchthecve.com/cve/CVE-2020-13992.htmlhttps://patchthecve.com/cve/CVE-2020-13992.htmlWed, 17 Jun 2026 02:54:03 +0000MEDIUM 6.1: An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A Stored XSS issue allows remote unauthenticated attackers to abuse a helpdesk user's logged in session. A user with sufficient privileges to change their login-page image must open a crafted ticket.