https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-33559.htmlhttps://patchthecve.com/cve/CVE-2023-33559.htmlWed, 17 Jun 2026 06:01:55 +0000HIGH 8.8: A local file inclusion vulnerability via the lang parameter in OcoMon before v4.0.1 allows attackers to execute arbitrary code by supplying a crafted PHP file.https://patchthecve.com/cve/CVE-2023-33558.htmlhttps://patchthecve.com/cve/CVE-2023-33558.htmlWed, 17 Jun 2026 06:01:55 +0000HIGH 7.5: An information disclosure vulnerability in the component users-grid-data.php of Ocomon before v4.0.1 allows attackers to obtain sensitive information such as e-mails and usernames.https://patchthecve.com/cve/CVE-2022-40798.htmlhttps://patchthecve.com/cve/CVE-2022-40798.htmlWed, 17 Jun 2026 05:02:02 +0000HIGH 7.5: OcoMon 4.0RC1 is vulnerable to Incorrect Access Control. Through a request the user can obtain the real email, sending the same request with correct email its possible to account takeover.https://patchthecve.com/cve/CVE-2022-41391.htmlhttps://patchthecve.com/cve/CVE-2022-41391.htmlWed, 17 Jun 2026 05:03:07 +0000CRITICAL 9.8: OcoMon v4.0 was discovered to contain a SQL injection vulnerability via the cod parameter at showImg.php.https://patchthecve.com/cve/CVE-2022-41390.htmlhttps://patchthecve.com/cve/CVE-2022-41390.htmlWed, 17 Jun 2026 05:03:07 +0000CRITICAL 9.8: OcoMon v4.0 was discovered to contain a SQL injection vulnerability via the cod parameter at download.php.