https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-15452.htmlhttps://patchthecve.com/cve/CVE-2025-15452.htmlWed, 07 Oct 2026 11:10:00 +0000LOW 2.4: A weakness has been identified in xnx3 wangmarket up to 4.9. This affects the function variableList of the file /admin/system/variableList.do of the component Backend Variable Search. Executing a manipulation of the argument Description can lead to cross site scripting. The attack may be launched rehttps://patchthecve.com/cve/CVE-2025-15451.htmlhttps://patchthecve.com/cve/CVE-2025-15451.htmlWed, 07 Oct 2026 11:10:00 +0000LOW 2.4: A security flaw has been discovered in xnx3 wangmarket up to 4.9. Affected by this issue is some unknown functionality of the file /admin/system/variableSave.do of the component System Variables Page. Performing a manipulation of the argument Description results in cross site scripting. The attack mhttps://patchthecve.com/cve/CVE-2025-15416.htmlhttps://patchthecve.com/cve/CVE-2025-15416.htmlWed, 07 Oct 2026 11:10:00 +0000LOW 2.4: A vulnerability was found in xnx3 wangmarket up to 6.4. This affects an unknown function of the file /siteVar/save.do of the component Add Global Variable Handler. The manipulation of the argument Remark/Variable Value results in cross site scripting. The attack can be executed remotely. The exploithttps://patchthecve.com/cve/CVE-2025-15415.htmlhttps://patchthecve.com/cve/CVE-2025-15415.htmlWed, 07 Oct 2026 11:10:00 +0000MEDIUM 4.7: A vulnerability has been found in xnx3 wangmarket up to 6.4. The impacted element is the function uploadImage of the file /sits/uploadImage.do of the component XML File Handler. The manipulation of the argument image leads to unrestricted upload. Remote exploitation of the attack is possible. The exhttps://patchthecve.com/cve/CVE-2025-25770.htmlhttps://patchthecve.com/cve/CVE-2025-25770.htmlWed, 17 Jun 2026 09:01:10 +0000MEDIUM 6.8: Wangmarket v4.10 to v5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /agency/AgencyUserController.java.https://patchthecve.com/cve/CVE-2025-25769.htmlhttps://patchthecve.com/cve/CVE-2025-25769.htmlWed, 17 Jun 2026 09:01:10 +0000HIGH 8.0: Wangmarket v4.10 to v5.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /controller/UserController.java.