https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2009-3191.htmlhttps://patchthecve.com/cve/CVE-2009-3191.htmlTue, 16 Jun 2026 23:11:06 +0000MEDIUM 4.3: Multiple cross-site scripting (XSS) vulnerabilities in PAD Site Scripts 3.6 allow remote attackers to inject arbitrary web script or HTML via the cat parameter to (1) rss.php and (2) opml.php.https://patchthecve.com/cve/CVE-2009-3190.htmlhttps://patchthecve.com/cve/CVE-2009-3190.htmlTue, 16 Jun 2026 23:11:06 +0000HIGH 7.5: Multiple SQL injection vulnerabilities in PAD Site Scripts 3.6 allow remote attackers to execute arbitrary SQL commands via the (1) search parameter to list.php and (2) cat parameter to rss.php.https://patchthecve.com/cve/CVE-2009-1941.htmlhttps://patchthecve.com/cve/CVE-2009-1941.htmlTue, 16 Jun 2026 23:08:24 +0000MEDIUM 5.0: PAD Site Scripts 3.6 stores sensitive information under the web document root with insufficient access control, which allows remote attackers to download the database and obtain sensitive information via a direct request for dbbackup.txt.https://patchthecve.com/cve/CVE-2009-1739.htmlhttps://patchthecve.com/cve/CVE-2009-1739.htmlTue, 16 Jun 2026 23:07:57 +0000HIGH 7.5: PAD Site Scripts 3.6 allows remote attackers to bypass authentication and gain privileges as other users, including administrative privileges, by setting the authuser cookie parameter to a valid username.