https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-67830.htmlhttps://patchthecve.com/cve/CVE-2025-67830.htmlWed, 17 Jun 2026 09:58:09 +0000CRITICAL 9.8: Mura before 10.1.14 allows beanFeed.cfc getQuery sortby SQL injection.https://patchthecve.com/cve/CVE-2025-67829.htmlhttps://patchthecve.com/cve/CVE-2025-67829.htmlWed, 17 Jun 2026 09:58:09 +0000CRITICAL 9.8: Mura before 10.1.14 allows beanFeed.cfc getQuery sortDirection SQL injection.https://patchthecve.com/cve/CVE-2025-55046.htmlhttps://patchthecve.com/cve/CVE-2025-55046.htmlWed, 17 Jun 2026 09:41:09 +0000HIGH 8.1: MuraCMS through 10.1.10 contains a CSRF vulnerability that allows attackers to permanently destroy all deleted content stored in the trash system through a simple CSRF attack. The vulnerable cTrash.empty function lacks CSRF token validation, enabling malicious websites to forge requests that irreverhttps://patchthecve.com/cve/CVE-2025-55045.htmlhttps://patchthecve.com/cve/CVE-2025-55045.htmlWed, 17 Jun 2026 09:41:09 +0000HIGH 7.1: The update address CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to manipulate user address information through CSRF. The vulnerable cUsers.updateAddress function lacks CSRF token validation, enabling malicious websites to forge requests that add, modify, or delete user addresses whhttps://patchthecve.com/cve/CVE-2025-55044.htmlhttps://patchthecve.com/cve/CVE-2025-55044.htmlWed, 17 Jun 2026 09:41:09 +0000HIGH 8.8: The Trash Restore CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to restore deleted content from the trash to unauthorized locations through CSRF. The vulnerable cTrash.restore function lacks CSRF token validation, enabling malicious websites to forge requests that restore content tohttps://patchthecve.com/cve/CVE-2025-55043.htmlhttps://patchthecve.com/cve/CVE-2025-55043.htmlWed, 17 Jun 2026 09:41:09 +0000MEDIUM 6.5: MuraCMS through 10.1.10 contains a CSRF vulnerability in the bundle creation functionality (csettings.cfc createBundle method) that allows unauthenticated attackers to force administrators to create and save site bundles containing sensitive data to publicly accessible directories. This vulnerabilithttps://patchthecve.com/cve/CVE-2025-55041.htmlhttps://patchthecve.com/cve/CVE-2025-55041.htmlWed, 17 Jun 2026 09:41:09 +0000HIGH 8.0: MuraCMS through 10.1.10 contains a CSRF vulnerability in the Add To Group functionality for user management (cUsers.cfc addToGroup method) that allows attackers to escalate privileges by adding any user to any group without proper authorization checks. The vulnerable function lacks CSRF token validahttps://patchthecve.com/cve/CVE-2025-55040.htmlhttps://patchthecve.com/cve/CVE-2025-55040.htmlWed, 17 Jun 2026 09:41:09 +0000HIGH 8.8: The import form CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to upload and install malicious form definitions through a CSRF attack. The vulnerable cForm.importform function lacks CSRF token validation, enabling malicious websites to forge file upload requests that install attacker