PatchTheCVE: onekeyadminhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2023-26951: onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Member https://patchthecve.com/cve/CVE-2023-26951.htmlhttps://patchthecve.com/cve/CVE-2023-26951.htmlWed, 17 Jun 2026 05:43:59 +0000MEDIUM 5.4: onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Member List module.CVE-2023-26957: onekeyadmin v1.3.9 was discovered to contain an arbitrary file delete vulnerability via the component \admin\chttps://patchthecve.com/cve/CVE-2023-26957.htmlhttps://patchthecve.com/cve/CVE-2023-26957.htmlWed, 17 Jun 2026 05:44:00 +0000CRITICAL 9.1: onekeyadmin v1.3.9 was discovered to contain an arbitrary file delete vulnerability via the component \admin\controller\plugins.CVE-2023-26948: onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/fihttps://patchthecve.com/cve/CVE-2023-26948.htmlhttps://patchthecve.com/cve/CVE-2023-26948.htmlWed, 17 Jun 2026 05:43:58 +0000HIGH 7.5: onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/file/download.CVE-2023-26956: onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/cuhttps://patchthecve.com/cve/CVE-2023-26956.htmlhttps://patchthecve.com/cve/CVE-2023-26956.htmlWed, 17 Jun 2026 05:44:00 +0000HIGH 7.5: onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/curd/code.CVE-2023-26952: onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Menhttps://patchthecve.com/cve/CVE-2023-26952.htmlhttps://patchthecve.com/cve/CVE-2023-26952.htmlWed, 17 Jun 2026 05:43:59 +0000MEDIUM 5.4: onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Menu module.CVE-2023-26950: onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Title phttps://patchthecve.com/cve/CVE-2023-26950.htmlhttps://patchthecve.com/cve/CVE-2023-26950.htmlWed, 17 Jun 2026 05:43:59 +0000MEDIUM 5.4: onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Title parameter under the Adding Categories module.CVE-2023-26953: onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Admhttps://patchthecve.com/cve/CVE-2023-26953.htmlhttps://patchthecve.com/cve/CVE-2023-26953.htmlWed, 17 Jun 2026 05:43:59 +0000MEDIUM 4.8: onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Administrator module.CVE-2023-26949: An arbitrary file upload vulnerability in the component /admin1/config/update of onekeyadmin v1.3.9 allows atthttps://patchthecve.com/cve/CVE-2023-26949.htmlhttps://patchthecve.com/cve/CVE-2023-26949.htmlWed, 17 Jun 2026 05:43:59 +0000CRITICAL 9.8: An arbitrary file upload vulnerability in the component /admin1/config/update of onekeyadmin v1.3.9 allows attackers to execute arbitrary code via a crafted PHP file.