https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2007-1639.htmlhttps://patchthecve.com/cve/CVE-2007-1639.htmlTue, 16 Jun 2026 22:38:00 +0000MEDIUM 4.6: Unrestricted file upload vulnerability in PHProjekt 5.2.0, when magic_quotes_gpc is disabled, allows remote authenticated users to upload and execute arbitrary PHP code via a file with an executable extension, which is then accessed by the (1) calendar or (2) file management module, or possibly unsphttps://patchthecve.com/cve/CVE-2007-1638.htmlhttps://patchthecve.com/cve/CVE-2007-1638.htmlTue, 16 Jun 2026 22:38:00 +0000MEDIUM 6.8: Multiple cross-site request forgery (CSRF) vulnerabilities in the check_csrftoken function in lib/lib.inc.php in PHProjekt 5.2.0, when magic_quotes_gpc is disabled, allow remote attackers to perform unauthorized actions as an arbitrary user via the (1) Projects, (2) Contacts, (3) Helpdesk, (4) Noteshttps://patchthecve.com/cve/CVE-2006-4609.htmlhttps://patchthecve.com/cve/CVE-2006-4609.htmlTue, 16 Jun 2026 22:29:26 +0000MEDIUM 5.1: Multiple PHP remote file inclusion vulnerabilities in the Content Management module ("Content manager") for PHProjekt 0.6.1, when register_globals is enabled, allow remote attackers to execute arbitrary PHP code via the path_pre parameter in (1) cm_lib.inc.php, (2) doc/br.edithelp.php, (3) doc/de.edhttps://patchthecve.com/cve/CVE-2002-0451.htmlhttps://patchthecve.com/cve/CVE-2002-0451.htmlTue, 16 Jun 2026 21:57:28 +0000HIGH 7.5: filemanager_forms.php in PHProjekt 3.1 and 3.1a allows remote attackers to execute arbitrary PHP code by specifying the URL to the code in the lib_path parameter.https://patchthecve.com/cve/CVE-2001-0995.htmlhttps://patchthecve.com/cve/CVE-2001-0995.htmlTue, 16 Jun 2026 21:55:22 +0000HIGH 7.5: PHProjekt before 2.4a allows remote attackers to perform actions as other PHProjekt users by modifying the ID number in an HTTP request to PHProjekt CGI programs.