https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2017-17937.htmlhttps://patchthecve.com/cve/CVE-2017-17937.htmlWed, 17 Jun 2026 01:11:55 +0000MEDIUM 6.1: Vanguard Marketplace Digital Products PHP has XSS via the phps_query parameter to /search.https://patchthecve.com/cve/CVE-2017-17936.htmlhttps://patchthecve.com/cve/CVE-2017-17936.htmlWed, 17 Jun 2026 01:11:55 +0000HIGH 8.8: Vanguard Marketplace Digital Products PHP has CSRF via /search.https://patchthecve.com/cve/CVE-2017-17874.htmlhttps://patchthecve.com/cve/CVE-2017-17874.htmlWed, 17 Jun 2026 01:11:48 +0000HIGH 8.8: Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can make a .php file accessible under a uploads/ URI.https://patchthecve.com/cve/CVE-2017-17873.htmlhttps://patchthecve.com/cve/CVE-2017-17873.htmlWed, 17 Jun 2026 01:11:48 +0000CRITICAL 9.8: Vanguard Marketplace Digital Products PHP 1.4 has SQL Injection via the PATH_INFO to the /p URI.