https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-1062.htmlhttps://patchthecve.com/cve/CVE-2026-1062.htmlWed, 17 Jun 2026 10:14:55 +0000MEDIUM 6.3: A flaw has been found in xiweicheng TMS up to 2.28.0. This affects the function Summary of the file src/main/java/com/lhjz/portal/util/HtmlUtil.java. This manipulation of the argument url causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been publishhttps://patchthecve.com/cve/CVE-2026-1061.htmlhttps://patchthecve.com/cve/CVE-2026-1061.htmlWed, 17 Jun 2026 10:14:55 +0000MEDIUM 6.3: A vulnerability was detected in xiweicheng TMS up to 2.28.0. Affected by this issue is the function Upload of the file src/main/java/com/lhjz/portal/controller/FileController.java. The manipulation of the argument filename results in unrestricted upload. The attack may be performed from remote. The https://patchthecve.com/cve/CVE-2025-14801.htmlhttps://patchthecve.com/cve/CVE-2025-14801.htmlWed, 17 Jun 2026 08:36:34 +0000LOW 2.4: A security vulnerability has been detected in xiweicheng TMS up to 2.28.0. This affects the function createComment of the file /admin/blog/comment/create. Such manipulation of the argument content leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed