https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-62170.htmlhttps://patchthecve.com/cve/CVE-2025-62170.htmlMon, 19 Oct 2026 16:10:00 +0000HIGH 7.5: rAthena is an open-source cross-platform MMORPG server. A use-after-free vulnerability exists in the RODEX functionality of rAthena's map-server in versions prior to commit af2f3ba. An unauthenticated attacker can exploit this vulnerability via a specific attacking scenario to cause a denial of servhttps://patchthecve.com/cve/CVE-2025-58750.htmlhttps://patchthecve.com/cve/CVE-2025-58750.htmlMon, 19 Oct 2026 17:10:00 +0000HIGH 8.2: rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0cc348b are missing a bound check in `chclif_parse_moveCharSlot` that can result in reading and writing out of bounds using input from the user. The problem has been fixehttps://patchthecve.com/cve/CVE-2025-58448.htmlhttps://patchthecve.com/cve/CVE-2025-58448.htmlMon, 19 Oct 2026 17:10:00 +0000CRITICAL 9.1: rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 0d89ae0 have a SQL Injection in the PartyBooking component via `WorldName` parameter. Commit 0d89ae0 fixes the issue.https://patchthecve.com/cve/CVE-2025-58447.htmlhttps://patchthecve.com/cve/CVE-2025-58447.htmlMon, 19 Oct 2026 17:10:00 +0000CRITICAL 9.8: rAthena is an open-source cross-platform massively multiplayer online role playing game (MMORPG) server. Versions prior to commit 2f5248b have a heap-based buffer overflow in the login server, remote attacker to overwrite adjacent session fields by sending a crafted `CA_SSO_LOGIN_REQ` with an oversihttps://patchthecve.com/cve/CVE-2024-45799.htmlhttps://patchthecve.com/cve/CVE-2024-45799.htmlWed, 17 Jun 2026 07:54:50 +0000HIGH 7.3: FluxCP is a web-based Control Panel for rAthena servers written in PHP. A javascript injection is possible via venders/buyers list pages and shop names, that are currently not sanitized. This allows executing arbitrary javascript code on the user's browser just by visiting the shop pages. As a resul