https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2008-0149.htmlhttps://patchthecve.com/cve/CVE-2008-0149.htmlTue, 16 Jun 2026 22:49:02 +0000MEDIUM 5.0: TUTOS 1.3 allows remote attackers to read system information via a direct request to php/admin/phpinfo.php, which calls the phpinfo function.https://patchthecve.com/cve/CVE-2008-0148.htmlhttps://patchthecve.com/cve/CVE-2008-0148.htmlTue, 16 Jun 2026 22:49:02 +0000HIGH 10.0: TUTOS 1.3 does not restrict access to php/admin/cmd.php, which allows remote attackers to execute arbitrary shell commands via the cmd parameter in a direct request.https://patchthecve.com/cve/CVE-2004-2162.htmlhttps://patchthecve.com/cve/CVE-2004-2162.htmlTue, 16 Jun 2026 22:09:08 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in TUTOS 1.1 allow remote attackers to inject arbitrary web script or HTML via (1) the search field of the Address Module or (2) the t parameter to app_new.php.https://patchthecve.com/cve/CVE-2004-2161.htmlhttps://patchthecve.com/cve/CVE-2004-2161.htmlTue, 16 Jun 2026 22:09:07 +0000HIGH 7.5: SQL injection vulnerability in file_overview.php in TUTOS 1.1 allows remote attackers to execute arbitrary SQL commands via the link_id parameter.