CVE-2015-1177

Exponent CMS 2.3.2 is affected by a reflected cross-site scripting (XSS) vulnerability in index.php, exploitable via the src parameter in the search functionality. Technical details across sources show that an attacker can craft a URL containing malicious JavaScript (e.g., payloads like or onerr...

CVE-2015-1177

Cross-site scripting XSS vulnerability in Exponent CMS 2.3.2...

Exponent CMS eaasController.php api Function SQL Injection (CVE-2017-7991)

A SQL injection vulnerability has been reported in Exponent CMS. The vulnerability is due to a lack of input validation on the apikey HTTP parameter by the api function. A remote, unauthenticated user can exploit this vulnerability by sending a crafted HTTP request to the affected page...

Exponent CMS SQL Injection

SQL Injection vulnerability in Exponent CMS expCommentController.php contentid parameter Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

Exponent CMS 2.3.9 LFI

Local file include vulnerability in Exponent CMS page parameter Vulnerability Type: Local File Include For the exploit source code contact DSquare Security sales team...

Exponent CMS Cross-Site Scripting Vulnerability (CNVD-2017-06734)

Exponent CMS is a free, open source, modular PHP-based content management system CMS. The system supports direct editing in the page and provides user management, site configuration, content editing and other functions. A cross-site scripting vulnerability exists in the...

Multiple SQL Injection Vulnerabilities in OIC Exponent CMS

OIC Exponent CMS is a free, open source modular content management system CMS based on PHP from the American OIC Group of companies. The system supports direct editing in the page, and provides user management, site configuration, content editing and other functions. Exponent CMS 2.4.1 version of...

Code injection

In Exponent CMS before 2.4.1 Patch 5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php...

CVE-2017-8085

In Exponent CMS before 2.4.1 Patch 5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php...

CVE-2017-8085

In Exponent CMS before 2.4.1 Patch 5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php...

CVE-2017-8085

In Exponent CMS before 2.4.1 Patch 5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php...

CVE-2017-8085

Exponent CMS vulnerable before 2.4.1 Patch #5 due to an XSS flaw in elFinder (framework/modules/file/connector/elfinder.php). The issue affects Exponent CMS versions prior to 2.4.1 Patch #5; patch 2.4.1 Patch #5 fixes the vulnerability. The connected sources describe the vulnerability as a cross-...

CVE-2017-7991

Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key apikey parameter in the api function of framework/modules/eaas/controllers/eaasController.php...

CVE-2017-7991

Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key apikey parameter in the api function of framework/modules/eaas/controllers/eaasController.php...

Sql injection

Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key apikey parameter in the api function of framework/modules/eaas/controllers/eaasController.php...

CVE-2017-7991

Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key apikey parameter in the api function of framework/modules/eaas/controllers/eaasController.php...

CVE-2017-7991

Exponent CMS 2.4.1 and earlier is affected by a SQL injection in the api() function of framework/modules/eaas/controllers/eaasController.php. The root cause is lack of input validation on the apikey parameter, which is base64-encoded, URL-decoded, and unserialized (via expUnserialize) before furt...

Exponent CMS 2.4.1 SQL Injection Vulnerability

Exponent CMS versions 2.4.1 and below suffer from a remote SQL injection vulnerability. CVE-2017-7991-SQL injection-Exponent CMS Suggested description Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key apikey parameter in the api function of...

Exponent CMS 2.4.1 SQL Injection

CVE-2017-7991-SQL injection-Exponent CMS Suggested description Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key apikey parameter in the api function of framework/modules/eaas/controllers/eaasController.php. ------------------------------------------ Additional...

Exponent CMS < 2.4.0 Multiple SQLi and RCE Vulnerabilities

Exponent CMS is prone to multiple SQL injection SQLi and remote code execution RCE vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...