https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2021-38113.htmlhttps://patchthecve.com/cve/CVE-2021-38113.htmlWed, 17 Jun 2026 04:01:29 +0000MEDIUM 5.4: In addBouquet in js/bqe.js in OpenWebif (aka e2openplugin-OpenWebif) through 1.4.7, inserting JavaScript into the Add Bouquet feature of the Bouquet Editor (i.e., bouqueteditor/api/addbouquet?name=) leads to Stored XSS.https://patchthecve.com/cve/CVE-2018-20332.htmlhttps://patchthecve.com/cve/CVE-2018-20332.htmlWed, 17 Jun 2026 01:52:38 +0000HIGH 7.5: An issue has been discovered in the OpenWebif plugin through 1.2.4 for Enigma2 based devices. Reading of arbitrary files is possible with /file?action=download&file= followed by a full pathname, and listing of arbitrary directories is possible with /file?action=download&dir= followed by a full pathnhttps://patchthecve.com/cve/CVE-2017-9333.htmlhttps://patchthecve.com/cve/CVE-2017-9333.htmlWed, 17 Jun 2026 01:27:54 +0000HIGH 8.8: OpenWebif 1.2.5 allows remote code execution via a URL to the CallOPKG function in the IpkgController class in plugin/controllers/ipkg.py, when the URL refers to an attacker-controlled web site with a Trojan horse package. This has security implications in cases where untrusted users can trigger Calhttps://patchthecve.com/cve/CVE-2017-9807.htmlhttps://patchthecve.com/cve/CVE-2017-9807.htmlWed, 17 Jun 2026 01:28:57 +0000CRITICAL 9.8: An issue was discovered in the OpenWebif plugin through 1.2.4 for E2 open devices. The saveConfig function of "plugin/controllers/models/config.py" performs an eval() call on the contents of the "key" HTTP GET parameter. This allows an unauthenticated remote attacker to execute arbitrary Python code