https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-29879.htmlhttps://patchthecve.com/cve/CVE-2024-29879.htmlWed, 17 Jun 2026 07:23:17 +0000HIGH 7.1: Cross-Site Scripting (XSS) vulnerability in Sentrifugo 3.2, through  /sentrifugo/index.php/index/getdepartments/format/html, 'business_id' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data. https://patchthecve.com/cve/CVE-2024-29878.htmlhttps://patchthecve.com/cve/CVE-2024-29878.htmlWed, 17 Jun 2026 07:23:17 +0000HIGH 7.1: Cross-Site Scripting (XSS) vulnerability in Sentrifugo 3.2, through  /sentrifugo/index.php/sitepreference/add, 'description' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session data. https://patchthecve.com/cve/CVE-2024-29877.htmlhttps://patchthecve.com/cve/CVE-2024-29877.htmlWed, 17 Jun 2026 07:23:17 +0000HIGH 7.1: Cross-Site Scripting (XSS) vulnerability in Sentrifugo 3.2, through  /sentrifugo/index.php/expenses/expensecategories/edit, 'expense_category_name' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal their session datahttps://patchthecve.com/cve/CVE-2024-29876.htmlhttps://patchthecve.com/cve/CVE-2024-29876.htmlWed, 17 Jun 2026 07:23:17 +0000CRITICAL 9.8: SQL injection vulnerability in Sentrifugo 3.2, through  /sentrifugo/index.php/reports/activitylogreport, 'sortby' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it.https://patchthecve.com/cve/CVE-2024-29875.htmlhttps://patchthecve.com/cve/CVE-2024-29875.htmlWed, 17 Jun 2026 07:23:17 +0000CRITICAL 9.8: SQL injection vulnerability in Sentrifugo 3.2, through  /sentrifugo/index.php/default/reports/exportactiveuserrpt, 'sort_name' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it.https://patchthecve.com/cve/CVE-2024-29874.htmlhttps://patchthecve.com/cve/CVE-2024-29874.htmlWed, 17 Jun 2026 07:23:16 +0000CRITICAL 9.8: SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/default/reports/activeuserrptpdf, 'sort_name' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it.https://patchthecve.com/cve/CVE-2024-29873.htmlhttps://patchthecve.com/cve/CVE-2024-29873.htmlWed, 17 Jun 2026 07:23:16 +0000CRITICAL 9.8: SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/reports/businessunits/format/html, 'bunitname' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it.https://patchthecve.com/cve/CVE-2024-29872.htmlhttps://patchthecve.com/cve/CVE-2024-29872.htmlWed, 17 Jun 2026 07:23:16 +0000CRITICAL 9.8: SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/empscreening/add, 'agencyids' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the data from it.https://patchthecve.com/cve/CVE-2024-29871.htmlhttps://patchthecve.com/cve/CVE-2024-29871.htmlWed, 17 Jun 2026 07:23:16 +0000CRITICAL 9.8: SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/index/getdepartments/sentrifugo/index.php/index/updatecontactnumber, 'id' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the datahttps://patchthecve.com/cve/CVE-2024-29870.htmlhttps://patchthecve.com/cve/CVE-2024-29870.htmlWed, 17 Jun 2026 07:23:16 +0000CRITICAL 9.8: SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/index/getdepartments/format/html, 'business_id' parameter./sentrifugo/index.php/index/getdepartments/format/html, 'business_id' parameter. The exploitation of this vulnerability could allow a remote user to send a speciallhttps://patchthecve.com/cve/CVE-2023-29770.htmlhttps://patchthecve.com/cve/CVE-2023-29770.htmlWed, 17 Jun 2026 05:50:50 +0000HIGH 8.8: In Sentrifugo 3.5, the AssetsController::uploadsaveAction function allows an authenticated attacker to upload any file without extension filtering.