https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-28517.htmlhttps://patchthecve.com/cve/CVE-2026-28517.htmlTue, 14 Jul 2026 19:16:53 +0000CRITICAL 9.8: openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec() without validation or sanitization. If an attacker can modify the https://patchthecve.com/cve/CVE-2026-28516.htmlhttps://patchthecve.com/cve/CVE-2026-28516.htmlTue, 14 Jul 2026 19:16:53 +0000HIGH 8.8: openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements using string interpolation without prepared statements or proper input sanitatihttps://patchthecve.com/cve/CVE-2026-28515.htmlhttps://patchthecve.com/cve/CVE-2026-28515.htmlTue, 14 Jul 2026 19:16:53 +0000HIGH 8.8: openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php. The installer and upgrade handler expose LDAP configuration functionality without enforcing application role checks. Any authenticated user can access this functi