PatchTheCVE: constructr-cmshttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2008-5860: Directory traversal vulnerability in backend/template.php in Constructr CMS 3.02.5 and earlier, when register_https://patchthecve.com/cve/CVE-2008-5860.htmlhttps://patchthecve.com/cve/CVE-2008-5860.htmlTue, 16 Jun 2026 23:01:07 +0000MEDIUM 5.1: Directory traversal vulnerability in backend/template.php in Constructr CMS 3.02.5 and earlier, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to create or read arbitrary files via directory traversal sequences in the edit_file parameter.CVE-2008-5859: SQL injection vulnerability in index.php in Constructr CMS 3.02.5 and earlier, when register_globals is enablehttps://patchthecve.com/cve/CVE-2008-5859.htmlhttps://patchthecve.com/cve/CVE-2008-5859.htmlTue, 16 Jun 2026 23:01:06 +0000MEDIUM 5.1: SQL injection vulnerability in index.php in Constructr CMS 3.02.5 and earlier, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the show_page parameter.CVE-2008-5847: Constructr CMS 3.02.5 and earlier stores passwords in cleartext in a MySQL database, which allows context-depehttps://patchthecve.com/cve/CVE-2008-5847.htmlhttps://patchthecve.com/cve/CVE-2008-5847.htmlTue, 16 Jun 2026 23:01:05 +0000LOW 2.6: Constructr CMS 3.02.5 and earlier stores passwords in cleartext in a MySQL database, which allows context-dependent attackers to obtain sensitive information by reading the hash column.