https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-13786.htmlhttps://patchthecve.com/cve/CVE-2025-13786.htmlSun, 18 Oct 2026 18:10:00 +0000HIGH 7.3: A vulnerability was detected in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. Impacted is the function fetch of the file /index.php. Performing manipulation of the argument content results in code injection. It is possible to initiate the attack remotely. The exploit is now public andhttps://patchthecve.com/cve/CVE-2025-13783.htmlhttps://patchthecve.com/cve/CVE-2025-13783.htmlSun, 18 Oct 2026 18:10:00 +0000MEDIUM 6.3: A security flaw has been discovered in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. This affects the function check/uncheck/delete of the file application/Comment/Controller/CommentadminController.class.php of the component CommentadminController. The manipulation of the argument idshttps://patchthecve.com/cve/CVE-2025-13782.htmlhttps://patchthecve.com/cve/CVE-2025-13782.htmlWed, 07 Oct 2026 20:10:01 +0000HIGH 7.3: A vulnerability was identified in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. Affected by this issue is the function delete of the file application/Admin/Controller/SlideController.class.php of the component SlideController. The manipulation of the argument ids leads to sql injectiohttps://patchthecve.com/cve/CVE-2024-48239.htmlhttps://patchthecve.com/cve/CVE-2024-48239.htmlWed, 17 Jun 2026 07:58:20 +0000MEDIUM 4.8: An issue was discovered in WTCMS 1.0. In the plupload method in \AssetController.class.php, the app parameters aren't processed, resulting in Cross Site Scripting (XSS).https://patchthecve.com/cve/CVE-2024-48238.htmlhttps://patchthecve.com/cve/CVE-2024-48238.htmlWed, 17 Jun 2026 07:58:20 +0000MEDIUM 4.7: WTCMS 1.0 is vulnerable to SQL Injection in the edit_post method of /Admin\Controller\NavControl.class.php via the parentid parameter.https://patchthecve.com/cve/CVE-2024-48237.htmlhttps://patchthecve.com/cve/CVE-2024-48237.htmlWed, 17 Jun 2026 07:58:20 +0000CRITICAL 9.8: WTCMS 1.0 is vulnerable to Incorrect Access Control in \Common\Controller\HomebaseController.class.php.