Browse CVEs

HIGH 7.5 CVE-2021-32441 SQL Injection vulnerability in Exponent-CMS v.2.6.0 fixed in 2.7.0 allows attackers to gain access to sensitive information via the selectValue funct… Exponent Cms 2.7.0+ Fix from $1,9502023-02-17 HIGH 7.2 CVE-2022-23048 Exponent CMS 2.6.0patch2 allows an authenticated admin user to upload a malicious extension in the format of a ZIP file with a PHP file inside it. Af… Exponent Cms No fix yet Fix from $1,9502022-02-09 MEDIUM 5.4 CVE-2022-23049 Exponent CMS 2.6.0patch2 allows an authenticated user to inject persistent JavaScript code on the "User-Agent" header when logging in. When an admini… Exponent Cms No fix yet Fix from $1,6002022-02-09 CRITICAL 9.8 CVE-2016-9021 Exponent CMS before 2.6.0 has improper input validation in storeController.php. Exponent Cms 2.6.0+ Fix from $2,3002020-12-31 CRITICAL 9.8 CVE-2016-9022 Exponent CMS before 2.6.0 has improper input validation in usersController.php. Exponent Cms 2.6.0+ Fix from $2,3002020-12-31 CRITICAL 9.8 CVE-2016-9023 Exponent CMS before 2.6.0 has improper input validation in cron/find_help.php. Exponent Cms 2.6.0+ Fix from $2,3002020-12-31 CRITICAL 9.8 CVE-2016-9025 Exponent CMS before 2.6.0 has improper input validation in purchaseOrderController.php. Exponent Cms 2.6.0+ Fix from $2,3002020-12-31 CRITICAL 9.8 CVE-2016-9026 Exponent CMS before 2.6.0 has improper input validation in fileController.php. Exponent Cms 2.6.0+ Fix from $2,3002020-12-31 CRITICAL 9.8 CVE-2016-8898 Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/ecommerce/controllers/cartController.php. Exponent Cms Patch available Fix from $2,3002019-05-24 CRITICAL 9.8 CVE-2016-8900 Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expTagController.php related to change… Exponent Cms Patch available Fix from $2,3002019-05-24 CRITICAL 9.8 CVE-2016-8897 Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/help/controllers/helpController.php. Exponent Cms Patch available Fix from $2,3002019-05-23 CRITICAL 9.8 CVE-2016-8899 Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expCatController.php related to change… Exponent Cms Patch available Fix from $2,3002019-05-23 CRITICAL 9.8 CVE-2016-7443 Exponent CMS 2.3.0 through 2.3.9 allows remote attackers to have unspecified impact via vectors related to "uploading files to wrong location." Exponent Cms after 2.3.9 Fix from $2,3002018-03-07 HIGH 7.2 CVE-2017-18213 In Exponent CMS before 2.4.1 Patch #6, certain admin users can elevate their privileges. Exponent Cms after 2.4.1 Fix from $1,9502018-03-04 MEDIUM 6.1 CVE-2015-1177 Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.2. Exponent Cms No fix yet Fix from $1,6002017-08-28 MEDIUM 6.1 CVE-2017-8085 In Exponent CMS before 2.4.1 Patch #5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php. Exponent Cms after 2.4.0 Fix from $1,6002017-04-24 CRITICAL 9.8 CVE-2017-7991 Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key (apikey parameter) in the api function of framework/modules/eaas/con… Exponent Cms after 2.4.1 Fix from $2,3002017-04-22 CRITICAL 9.8 CVE-2016-7780 SQL injection vulnerability in cron/find_help.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the… Exponent Cms after 2.3.9 Fix from $2,3002017-03-07 CRITICAL 9.8 CVE-2016-7781 SQL injection vulnerability in framework/modules/blog/controllers/blogController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to exe… Exponent Cms after 2.3.9 Fix from $2,3002017-03-07 CRITICAL 9.8 CVE-2016-7782 SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL… Exponent Cms after 2.3.9 Fix from $2,3002017-03-07 CRITICAL 9.8 CVE-2016-7783 SQL injection vulnerability in framework/core/models/expRecord.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL… Exponent Cms after 2.3.9 Fix from $2,3002017-03-07 CRITICAL 9.8 CVE-2016-7784 SQL injection vulnerability in the getSection function in framework/core/subsystems/expRouter.php in Exponent CMS 2.3.9 and earlier allows remote att… Exponent Cms after 2.3.9 Fix from $2,3002017-03-07 CRITICAL 9.8 CVE-2016-7788 SQL injection vulnerability in framework/modules/users/models/user.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary… Exponent Cms after 2.3.9 Fix from $2,3002017-03-07 CRITICAL 9.8 CVE-2016-7789 SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL… Exponent Cms after 2.3.9 Fix from $2,3002017-03-07 CRITICAL 9.8 CVE-2016-9019 SQL injection vulnerability in the activate_address function in framework/modules/addressbook/controllers/addressController.php in Exponent CMS 2.3.9… Exponent Cms after 2.3.9 Fix from $2,3002017-03-07 CRITICAL 9.8 CVE-2016-9020 SQL injection vulnerability in framework/modules/help/controllers/helpController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to exe… Exponent Cms after 2.3.9 Fix from $2,3002017-03-07 CRITICAL 9.8 CVE-2016-9087 SQL injection vulnerability in framework/modules/filedownloads/controllers/filedownloadController.php in Exponent CMS 2.3.9 and earlier allows remote… Exponent Cms after 2.3.9 Fix from $2,3002017-03-07 CRITICAL 9.8 CVE-2016-7565 install/index.php in Exponent CMS 2.3.9 allows remote attackers to execute arbitrary commands via shell metacharacters in the sc array parameter. Exponent Cms Patch available Fix from $2,3002017-02-13 CRITICAL 9.8 CVE-2016-7400 Multiple SQL injection vulnerabilities in Exponent CMS before 2.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter… Exponent Cms after 2.3.9 Fix from $2,3002017-02-07 CRITICAL 9.8 CVE-2017-5879 An issue was discovered in Exponent CMS 2.4.1. This is a blind SQL injection that can be exploited by un-authenticated users via an HTTP GET request … Exponent Cms Patch available Fix from $2,3002017-02-06