Vulnerabilities

TI-2008-05556 CVE-2008-5860 · GHSA-7rg8-6m5r-jc3p

Directory traversal vulnerability in backend/template.php in Constructr CMS 3.02.5 and…

LOW 27

Directory traversal vulnerability in backend/template.php in Constructr CMS 3.02.5 and earlier, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to create or read arbitrary files…

CVSS 2.0MEDIUM 5.1 Network No auth Interaction — EPSS 0.02048 Published 2009-01-06 No fix listed CWE-22

TI-2008-05555 CVE-2008-5859 · GHSA-8j4p-hm4m-gch2

SQL injection vulnerability in index.php in Constructr CMS 3.02.5 and earlier, when…

LOW 25

SQL injection vulnerability in index.php in Constructr CMS 3.02.5 and earlier, when register_globals is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the show_pag…

CVSS 2.0MEDIUM 5.1 Network No auth Interaction — EPSS 0.00918 Published 2009-01-06 No fix listed CWE-89

TI-2008-05544 CVE-2008-5847 · GHSA-8m6h-hpr3-hm4g

Constructr CMS 3.02.5 and earlier stores passwords in cleartext in a MySQL database…

LOW 17

Constructr CMS 3.02.5 and earlier stores passwords in cleartext in a MySQL database, which allows context-dependent attackers to obtain sensitive information by reading the hash column.

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.01779 Published 2009-01-05 No fix listed CWE-255

Vulnerabilities

Filters

Directory traversal vulnerability in backend/template.php in Constructr CMS 3.02.5 and…

SQL injection vulnerability in index.php in Constructr CMS 3.02.5 and earlier, when…

Constructr CMS 3.02.5 and earlier stores passwords in cleartext in a MySQL database…