https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2019-15089.htmlhttps://patchthecve.com/cve/CVE-2019-15089.htmlWed, 17 Jun 2026 02:19:40 +0000HIGH 8.8: An issue was discovered in PRiSE adAS 1.7.0. Forms have no CSRF protection, letting an attacker execute actions as the administrator.https://patchthecve.com/cve/CVE-2019-15088.htmlhttps://patchthecve.com/cve/CVE-2019-15088.htmlWed, 17 Jun 2026 02:19:40 +0000CRITICAL 9.8: An issue was discovered in PRiSE adAS 1.7.0. Password hashes are compared using the equality operator. Thus, under specific circumstances, it is possible to bypass login authentication.https://patchthecve.com/cve/CVE-2019-15087.htmlhttps://patchthecve.com/cve/CVE-2019-15087.htmlWed, 17 Jun 2026 02:19:40 +0000HIGH 7.2: An issue was discovered in PRiSE adAS 1.7.0. An authenticated user can change the function used to hash passwords to any function, leading to remote code execution.https://patchthecve.com/cve/CVE-2019-15086.htmlhttps://patchthecve.com/cve/CVE-2019-15086.htmlWed, 17 Jun 2026 02:19:40 +0000MEDIUM 6.1: An issue was discovered in PRiSE adAS 1.7.0. The newentityID parameter is not properly escaped, leading to a reflected XSS in the error message.https://patchthecve.com/cve/CVE-2019-15085.htmlhttps://patchthecve.com/cve/CVE-2019-15085.htmlWed, 17 Jun 2026 02:19:40 +0000HIGH 7.5: An issue was discovered in PRiSE adAS 1.7.0. The current database password is embedded in the change password form.https://patchthecve.com/cve/CVE-2019-14916.htmlhttps://patchthecve.com/cve/CVE-2019-14916.htmlWed, 17 Jun 2026 02:19:18 +0000MEDIUM 6.5: An issue was discovered in PRiSE adAS 1.7.0. A file's format is not properly checked, leading to an unrestricted file upload.https://patchthecve.com/cve/CVE-2019-14915.htmlhttps://patchthecve.com/cve/CVE-2019-14915.htmlWed, 17 Jun 2026 02:19:18 +0000MEDIUM 6.1: An issue was discovered in PRiSE adAS 1.7.0. Certificate data are not properly escaped. This leads to XSS when submitting a rogue certificate.https://patchthecve.com/cve/CVE-2019-14914.htmlhttps://patchthecve.com/cve/CVE-2019-14914.htmlWed, 17 Jun 2026 02:19:18 +0000CRITICAL 9.1: An issue was discovered in PRiSE adAS 1.7.0. The path is not properly escaped in the medatadata_del method, leading to an arbitrary file read and deletion via Directory Traversal.https://patchthecve.com/cve/CVE-2019-14913.htmlhttps://patchthecve.com/cve/CVE-2019-14913.htmlWed, 17 Jun 2026 02:19:18 +0000MEDIUM 5.4: An issue was discovered in PRiSE adAS 1.7.0. Log data are not properly escaped, leading to persistent XSS in the administration panel.https://patchthecve.com/cve/CVE-2019-14912.htmlhttps://patchthecve.com/cve/CVE-2019-14912.htmlWed, 17 Jun 2026 02:19:18 +0000MEDIUM 6.1: An issue was discovered in PRiSE adAS 1.7.0. The OPENSSO module does not properly check the goto parameter, leading to an open redirect that leaks the session cookie.https://patchthecve.com/cve/CVE-2019-14911.htmlhttps://patchthecve.com/cve/CVE-2019-14911.htmlWed, 17 Jun 2026 02:19:18 +0000MEDIUM 6.1: An issue was discovered in PRiSE adAS 1.7.0. The OPENSSO module does not properly escape output on error, leading to reflected XSS.