https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-15849.htmlhttps://patchthecve.com/cve/CVE-2020-15849.htmlWed, 17 Jun 2026 02:57:17 +0000HIGH 7.2: Re:Desk 2.3 has a blind authenticated SQL injection vulnerability in the SettingsController class, in the actionEmailTemplates() method. A malicious actor with access to an administrative account could abuse this vulnerability to recover sensitive data from the application's database, allowing for ahttps://patchthecve.com/cve/CVE-2020-15488.htmlhttps://patchthecve.com/cve/CVE-2020-15488.htmlWed, 17 Jun 2026 02:56:43 +0000HIGH 7.5: Re:Desk 2.3 allows insecure file upload.https://patchthecve.com/cve/CVE-2020-15487.htmlhttps://patchthecve.com/cve/CVE-2020-15487.htmlWed, 17 Jun 2026 02:56:43 +0000CRITICAL 9.8: Re:Desk 2.3 contains a blind unauthenticated SQL injection vulnerability in the getBaseCriteria() function in the protected/models/Ticket.php file. By modifying the folder GET parameter, it is possible to execute arbitrary SQL statements via a crafted URL. Unauthenticated remote command execution is