https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-9795.htmlhttps://patchthecve.com/cve/CVE-2025-9795.htmlWed, 17 Jun 2026 10:09:46 +0000MEDIUM 6.3: A vulnerability has been found in xujeff tianti 天梯 up to 2.3. The impacted element is the function ajaxUploadFile of the file src/main/java/com/jeff/tianti/controller/UploadController.java. The manipulation of the argument upfile leads to unrestricted upload. It is possible to initiate the attack rehttps://patchthecve.com/cve/CVE-2025-8807.htmlhttps://patchthecve.com/cve/CVE-2025-8807.htmlWed, 17 Jun 2026 10:07:40 +0000MEDIUM 6.3: A vulnerability was found in xujeff tianti 天梯 up to 2.3. It has been declared as critical. This vulnerability affects unknown code of the file /tianti-module-admin/user/ajax/save. The manipulation leads to missing authorization. The attack can be initiated remotely. The exploit has been disclosed tohttps://patchthecve.com/cve/CVE-2025-27910.htmlhttps://patchthecve.com/cve/CVE-2025-27910.htmlWed, 17 Jun 2026 09:04:22 +0000HIGH 8.0: tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/upd/status. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request.https://patchthecve.com/cve/CVE-2025-25908.htmlhttps://patchthecve.com/cve/CVE-2025-25908.htmlWed, 17 Jun 2026 09:01:17 +0000MEDIUM 5.4: A stored cross-site scripting (XSS) vulnerability in tianti v2.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the coverImageURL parameter at /article/ajax/save.https://patchthecve.com/cve/CVE-2025-25907.htmlhttps://patchthecve.com/cve/CVE-2025-25907.htmlWed, 17 Jun 2026 09:01:17 +0000HIGH 8.8: tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/save. This vulnerability allows attackers to execute arbitrary operations via a crafted GET or POST request.