https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-37505.htmlhttps://patchthecve.com/cve/CVE-2026-37505.htmlWed, 17 Jun 2026 10:41:33 +0000MEDIUM 4.9: SQL Injection via ORDER BY clause in V2Board thru 1.7.4. In app/Http/Controllers/Admin/UserController.php, the sort parameter from user input is passed directly to User::orderBy($sort, $sortType) without validation. An authenticated admin can sort users by any database column including password, remhttps://patchthecve.com/cve/CVE-2026-37504.htmlhttps://patchthecve.com/cve/CVE-2026-37504.htmlWed, 17 Jun 2026 10:41:33 +0000MEDIUM 5.3: Sensitive server_token exposed via GET parameter in V2Board thru 1.7.4. In app/Http/Controllers/Server/UniProxyController.php, the server authentication token is accepted via GET parameter transmission. The token appears in URLs such as /api/v1/server/UniProxy/user?token=SECRET, causing it to be rechttps://patchthecve.com/cve/CVE-2026-37503.htmlhttps://patchthecve.com/cve/CVE-2026-37503.htmlWed, 17 Jun 2026 10:41:33 +0000MEDIUM 6.9: Cross-Site Scripting (XSS) in V2Board thru 1.7.4. The custom_html field in theme configuration is rendered using Blade unescaped output in public/theme/v2board/dashboard.blade.php. An admin can inject arbitrary JavaScript via the saveThemeConfig API. All site visitors execute the payload, enabling c