PatchTheCVE: blestahttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2026-25616: Blesta 3.x through 5.x before 5.13.3 mishandles input validation, aka CORE-5665.https://patchthecve.com/cve/CVE-2026-25616.htmlhttps://patchthecve.com/cve/CVE-2026-25616.htmlWed, 17 Jun 2026 10:24:57 +0000MEDIUM 4.7: Blesta 3.x through 5.x before 5.13.3 mishandles input validation, aka CORE-5665.CVE-2026-25615: Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668.https://patchthecve.com/cve/CVE-2026-25615.htmlhttps://patchthecve.com/cve/CVE-2026-25615.htmlWed, 17 Jun 2026 10:24:57 +0000HIGH 7.2: Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5668.CVE-2026-25614: Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680.https://patchthecve.com/cve/CVE-2026-25614.htmlhttps://patchthecve.com/cve/CVE-2026-25614.htmlWed, 17 Jun 2026 10:24:57 +0000HIGH 7.5: Blesta 3.x through 5.x before 5.13.3 allows object injection, aka CORE-5680.CVE-2024-25859: A path traversal vulnerability in the /path/to/uploads/ directory of Blesta before v5.9.2 allows attackers to https://patchthecve.com/cve/CVE-2024-25859.htmlhttps://patchthecve.com/cve/CVE-2024-25859.htmlWed, 17 Jun 2026 07:16:38 +0000HIGH 7.1: A path traversal vulnerability in the /path/to/uploads/ directory of Blesta before v5.9.2 allows attackers to takeover user accounts and execute arbitrary code.