https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2020-23691.htmlhttps://patchthecve.com/cve/CVE-2020-23691.htmlWed, 17 Jun 2026 03:04:55 +0000CRITICAL 9.8: YFCMF v2.3.1 has a Remote Command Execution (RCE) vulnerability in the index.php.https://patchthecve.com/cve/CVE-2020-23689.htmlhttps://patchthecve.com/cve/CVE-2020-23689.htmlWed, 17 Jun 2026 03:04:54 +0000MEDIUM 4.8: In YFCMF v2.3.1, there is a stored XSS vulnerability in the comments section of the news page.https://patchthecve.com/cve/CVE-2018-16431.htmlhttps://patchthecve.com/cve/CVE-2018-16431.htmlWed, 17 Jun 2026 01:44:16 +0000HIGH 8.8: admin/admin/adminsave.html in YFCMF v3.0 allows CSRF to add an administrator account.