https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-1742.htmlhttps://patchthecve.com/cve/CVE-2025-1742.htmlWed, 17 Jun 2026 08:39:41 +0000MEDIUM 4.3: A vulnerability, which was classified as problematic, has been found in pihome-shc PiHome 2.0. Affected by this issue is some unknown functionality of the file /home.php. The manipulation of the argument page_name leads to cross site scripting. The attack may be launched remotely. The exploit has behttps://patchthecve.com/cve/CVE-2025-1214.htmlhttps://patchthecve.com/cve/CVE-2025-1214.htmlWed, 17 Jun 2026 08:38:37 +0000MEDIUM 6.3: A vulnerability classified as critical has been found in pihome-shc PiHome 2.0. This affects an unknown part of the file /user_accounts.php?uid of the component Role-Based Access Control. The manipulation leads to missing authorization. It is possible to initiate the attack remotely. The exploit hashttps://patchthecve.com/cve/CVE-2025-1213.htmlhttps://patchthecve.com/cve/CVE-2025-1213.htmlWed, 17 Jun 2026 08:38:36 +0000LOW 3.5: A vulnerability was found in pihome-shc PiHome 1.77. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The attack may be launched remotely. The exploit hahttps://patchthecve.com/cve/CVE-2025-1185.htmlhttps://patchthecve.com/cve/CVE-2025-1185.htmlWed, 17 Jun 2026 08:38:33 +0000MEDIUM 6.3: A vulnerability was found in pihome-shc PiHome 2.0. It has been classified as critical. This affects an unknown part of the file /ajax.php?Ajax=GetModal_Sensor_Graph. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the publichttps://patchthecve.com/cve/CVE-2025-1184.htmlhttps://patchthecve.com/cve/CVE-2025-1184.htmlWed, 17 Jun 2026 08:38:33 +0000MEDIUM 6.3: A vulnerability was found in pihome-shc PiHome 1.77 and classified as critical. Affected by this issue is some unknown functionality of the file /ajax.php?Ajax=GetModal_MQTTEdit. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been dis