https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-5149.htmlhttps://patchthecve.com/cve/CVE-2025-5149.htmlWed, 17 Jun 2026 09:47:19 +0000MEDIUM 5.6: A vulnerability was found in WCMS up to 8.3.11. It has been declared as critical. Affected by this vulnerability is the function getMemberByUid of the file /index.php?articleadmin/getallcon of the component Login. The manipulation of the argument uid leads to improper authentication. The attack can https://patchthecve.com/cve/CVE-2025-3800.htmlhttps://patchthecve.com/cve/CVE-2025-3800.htmlWed, 17 Jun 2026 09:20:41 +0000HIGH 7.3: A vulnerability has been found in WCMS 11 and classified as critical. Affected by this vulnerability is an unknown functionality of the file app/controllers/AnonymousController.php. The manipulation of the argument mobile_phone leads to sql injection. The attack can be launched remotely. The exploithttps://patchthecve.com/cve/CVE-2025-3799.htmlhttps://patchthecve.com/cve/CVE-2025-3799.htmlWed, 17 Jun 2026 09:20:41 +0000HIGH 7.3: A vulnerability, which was classified as critical, was found in WCMS 11. Affected is an unknown function of the file app/controllers/AnonymousController.php. The manipulation of the argument email/username leads to sql injection. It is possible to launch the attack remotely. The exploit has been dishttps://patchthecve.com/cve/CVE-2025-3798.htmlhttps://patchthecve.com/cve/CVE-2025-3798.htmlWed, 17 Jun 2026 09:20:41 +0000MEDIUM 4.7: A vulnerability, which was classified as critical, has been found in WCMS 11. This issue affects the function sub of the file app/admin/AdvadminController.php of the component Advertisement Image Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploihttps://patchthecve.com/cve/CVE-2025-2979.htmlhttps://patchthecve.com/cve/CVE-2025-2979.htmlWed, 17 Jun 2026 09:07:56 +0000LOW 2.4: A vulnerability classified as problematic has been found in WCMS 11. This affects an unknown part of the file /index.php?anonymous/setregister of the component Registration. The manipulation of the argument Username leads to cross site scripting. It is possible to initiate the attack remotely. The ehttps://patchthecve.com/cve/CVE-2025-2978.htmlhttps://patchthecve.com/cve/CVE-2025-2978.htmlWed, 17 Jun 2026 09:07:56 +0000MEDIUM 6.3: A vulnerability was found in WCMS 11. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php?articleadmin/upload/?&CKEditor=container&CKEditorFuncNum=1 of the component Article Publishing Page. The manipulation of the argument Upload leads to unreshttps://patchthecve.com/cve/CVE-2024-8875.htmlhttps://patchthecve.com/cve/CVE-2024-8875.htmlWed, 17 Jun 2026 08:23:28 +0000MEDIUM 5.4: A vulnerability classified as critical was found in vedees wcms up to 0.3.2. Affected by this vulnerability is an unknown functionality of the file /wex/finder.php. The manipulation of the argument p leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the