PatchTheCVEconstructr vulnerabilities
Recent CVEs affecting constructr products. 3 tracked.
constructr has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2009-01-06. Highest priority: CVE-2008-5860 (score 43/100).
- CVE-2008-5860 MEDIUM 5.1 UPGRADE Directory traversal vulnerability in backend/template.php in Constructr CMS 3.02.5 and earlier, when register_
- CVE-2008-5859 MEDIUM 5.1 UPGRADE SQL injection vulnerability in index.php in Constructr CMS 3.02.5 and earlier, when register_globals is enable
- CVE-2008-5847 LOW 2.6 UPGRADE Constructr CMS 3.02.5 and earlier stores passwords in cleartext in a MySQL database, which allows context-depe
FAQ
How do I fix constructr vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is constructr being exploited right now?
None of the tracked constructr CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which constructr CVE should I patch first?
CVE-2008-5860 currently ranks highest (43/100): Directory traversal vulnerability in backend/template.php in Constructr CMS 3.02.5 and earlier, when register_.