https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-6942.htmlhttps://patchthecve.com/cve/CVE-2024-6942.htmlWed, 17 Jun 2026 08:19:02 +0000LOW 3.5: A vulnerability, which was classified as problematic, was found in ThinkSAAS 3.7.0. Affected is an unknown function of the file app/system/action/anti.php of the component Admin Panel Security Center. The manipulation of the argument ip/email/phone leads to cross site scripting. It is possible to lahttps://patchthecve.com/cve/CVE-2024-6941.htmlhttps://patchthecve.com/cve/CVE-2024-6941.htmlWed, 17 Jun 2026 08:19:01 +0000LOW 3.5: A vulnerability, which was classified as problematic, has been found in ThinkSAAS 3.7.0. This issue affects some unknown processing of the file app/system/action/do.php. The manipulation of the argument site_title/site_subtitle/site_key/site_desc/site_url/site_email/site_icp leads to cross site scrihttps://patchthecve.com/cve/CVE-2024-40456.htmlhttps://patchthecve.com/cve/CVE-2024-40456.htmlWed, 17 Jun 2026 07:45:53 +0000CRITICAL 9.8: ThinkSAAS v3.7.0 was discovered to contain a SQL injection vulnerability via the name parameter at \system\action\update.php.https://patchthecve.com/cve/CVE-2024-40455.htmlhttps://patchthecve.com/cve/CVE-2024-40455.htmlWed, 17 Jun 2026 07:45:53 +0000LOW 2.7: An arbitrary file deletion vulnerability in ThinkSAAS v3.7 allows attackers to delete arbitrary files via a crafted request.https://patchthecve.com/cve/CVE-2024-33102.htmlhttps://patchthecve.com/cve/CVE-2024-33102.htmlWed, 17 Jun 2026 07:31:26 +0000MEDIUM 5.4: A stored cross-site scripting (XSS) vulnerability in the component /pubs/counter.php of ThinkSAAS v3.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the code parameter.https://patchthecve.com/cve/CVE-2024-33101.htmlhttps://patchthecve.com/cve/CVE-2024-33101.htmlWed, 17 Jun 2026 07:31:25 +0000MEDIUM 6.1: A stored cross-site scripting (XSS) vulnerability in the component /action/anti.php of ThinkSAAS v3.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the word parameter.