https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-45552.htmlhttps://patchthecve.com/cve/CVE-2023-45552.htmlWed, 17 Jun 2026 06:28:48 +0000MEDIUM 6.5: In VeridiumID before 3.5.0, a stored cross-site scripting (XSS) vulnerability has been discovered in the admin portal that allows an authenticated attacker to take over all accounts by sending malicious input via the self-service portal.https://patchthecve.com/cve/CVE-2023-44040.htmlhttps://patchthecve.com/cve/CVE-2023-44040.htmlWed, 17 Jun 2026 06:26:50 +0000MEDIUM 6.1: In VeridiumID before 3.5.0, the identity provider page is susceptible to a cross-site scripting (XSS) vulnerability that can be exploited by an internal unauthenticated attacker for JavaScript execution in the context of the user trying to authenticate.https://patchthecve.com/cve/CVE-2023-44038.htmlhttps://patchthecve.com/cve/CVE-2023-44038.htmlWed, 17 Jun 2026 06:26:50 +0000MEDIUM 6.5: In VeridiumID before 3.5.0, the identity provider page allows an unauthenticated attacker to discover information about registered users via an LDAP injection attack.https://patchthecve.com/cve/CVE-2023-44039.htmlhttps://patchthecve.com/cve/CVE-2023-44039.htmlWed, 17 Jun 2026 06:26:50 +0000CRITICAL 9.1: In VeridiumID before 3.5.0, the WebAuthn API allows an internal unauthenticated attacker (who can pass enrollment verifications and is allowed to enroll a FIDO key) to register their FIDO authenticator to a victim’s account and consequently take over the account.