https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-70960.htmlhttps://patchthecve.com/cve/CVE-2025-70960.htmlWed, 17 Jun 2026 10:03:29 +0000MEDIUM 5.4: A stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.https://patchthecve.com/cve/CVE-2025-70959.htmlhttps://patchthecve.com/cve/CVE-2025-70959.htmlWed, 17 Jun 2026 10:03:29 +0000MEDIUM 5.4: A stored cross-site scripting (XSS) vulnerability in the Jobs module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.https://patchthecve.com/cve/CVE-2020-36962.htmlhttps://patchthecve.com/cve/CVE-2020-36962.htmlThu, 08 Oct 2026 16:16:44 +0000CRITICAL 9.8: Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during export. Attackers can submit crafted payloads like '=10+20+cmd|' /C calc'!A0' in the message field to trigger arbitrary command execution when thhttps://patchthecve.com/cve/CVE-2026-23946.htmlhttps://patchthecve.com/cve/CVE-2026-23946.htmlWed, 17 Jun 2026 10:22:19 +0000MEDIUM 6.8: Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical deserialization vulnerability in the Helpdesk module (which is not enabled by default). This vulnerability allows Remote Code Execution (RCE)