CVE-2015-8667

CVE-2015-8667 affects Exponent CMS prior to 2.3.5. The vulnerability is a Cross-site Scripting (XSS) in the Reset Your Password module that allows injection of arbitrary script/HTML via the Username/Email field. Affected component: Reset Your Password workflow; root cause: insufficient sanitizati...

CVE-2015-8684

CVE-2015-8684 affects Exponent CMS prior to 2.3.7. The flaw arises from insufficiently restricting upload file types, enabling an attacker to upload an HTML file and trigger cross-site scripting via the elFinder functionality. Impact described as remote XSS and possibly other unspecified effects....

CVE-2015-8684: Improper Neutralization of Input During Web Page Generation

Exponent CMS before 2.3.7 does not properly restrict the types of files that can be uploaded, which allows remote attackers to conduct cross-site scripting XSS attacks and possibly have other unspecified impact as demonstrated by uploading a file with an .html extension, then accessing it via the...

CVE-2015-8667: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Reset Your Password module in Exponent CMS before 2.3.5 allows remote attackers to inject arbitrary web script or HTML via the Username/Email...

PT-2017-7460

Name of the Vulnerable Software and Affected Versions Exponent CMS versions prior to 2.3.5 Description A cross-site scripting XSS issue exists in the Reset Your Password module, allowing remote attackers to inject arbitrary web script or HTML via the Username/Email field. Recommendations For...

PT-2017-7465

Name of the Vulnerable Software and Affected Versions Exponent CMS versions prior to 2.3.7 Description The issue allows remote attackers to conduct cross-site scripting XSS attacks and possibly have other unspecified impact by uploading files with certain extensions, such as .html, and then...

PT-2017-3057

Name of the Vulnerable Software and Affected Versions Exponent CMS versions prior to 2.3.7 Patch 3 Description The issue is related to incorrect code generation management in the Exponent CMS content management system. Exploitation of this issue may allow a remote attacker to execute arbitrary co...

CVE-2016-7790

Exponent CMS 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload 'php' file to the website through uploaderpaste.php, then overwrite /framework/conf/config.php, which leads to arbitrary code execution...

CVE-2016-7791

Exponent CMS 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload an evil 'exploit.tar.gz' file to the website, then extract it by visiting '/install/index.php?installsample=../../files/exploit', which leads to arbitrary code execution...

Remote code execution

Exponent CMS 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload an evil 'exploit.tar.gz' file to the website, then extract it by visiting '/install/index.php?installsample=../../files/exploit', which leads to arbitrary code execution...

Remote code execution

Exponent CMS 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload 'php' file to the website through uploaderpaste.php, then overwrite /framework/conf/config.php, which leads to arbitrary code execution...

CVE-2016-7790

Exponent CMS 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload 'php' file to the website through uploaderpaste.php, then overwrite /framework/conf/config.php, which leads to arbitrary code execution...

CVE-2016-7791

Exponent CMS 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload an evil 'exploit.tar.gz' file to the website, then extract it by visiting '/install/index.php?installsample=../../files/exploit', which leads to arbitrary code execution...

CVE-2016-7790

Exponent CMS 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload 'php' file to the website through uploaderpaste.php, then overwrite /framework/conf/config.php, which leads to arbitrary code execution...

CVE-2016-7791

Exponent CMS 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload an evil 'exploit.tar.gz' file to the website, then extract it by visiting '/install/index.php?installsample=../../files/exploit', which leads to arbitrary code execution...

CVE-2016-7790

Exponent CMS 2.3.9 is affected by a remote code execution vulnerability in /install/index.php. An attacker can upload a PHP file via uploader_paste.php and then overwrite /framework/conf/config.php to achieve arbitrary code execution. This is enabled by the ability to place a crafted file on the ...

CVE-2016-7791

Exponent CMS 2.3.9 is affected by CVE-2016-7791, a remote code execution vulnerability in /install/index.php. An attacker can upload a crafted exploit.tar.gz and trigger extraction via /install/index.php?install_sample=../../files/exploit, leading to arbitrary code execution. NVD lists CVSSv2 bas...

CVE-2016-7791: Improper Input Validation

Exponent CMS 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload an evil 'exploit.tar.gz' file to the website, then extract it by visiting '/install/index.php?installsample=../../files/exploit', which leads to arbitrary code execution...

PT-2017-9346

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.3.9 Description The issue allows for remote code execution. An attacker can upload a malicious file, exploit.tar.gz, to the website and then extract it by visiting the "/install/index.php" endpoint with a specific query...

PT-2017-9345

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.3.9 Description The issue concerns a remote code execution problem. It is possible for an attacker to upload a php file through the "uploader paste.php" script, then overwrite the "/framework/conf/config.php" file. This...