CVE-2016-7790: Improper Input Validation

Exponent CMS 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload 'php' file to the website through uploaderpaste.php, then overwrite /framework/conf/config.php, which leads to arbitrary code execution...

OIC Exponent CMS SQL Injection Vulnerability (CNVD-2016-11771)

OIC Exponent CMS is a free, open source modular content management system CMS based on PHP from the American OIC Group of companies. The system supports direct editing in the page, and provides user management, site configuration, content editing and other functions. A security vulnerability exis...

CVE-2016-9481

In framework/modules/core/controllers/expCommentController.php of Exponent CMS 2.4.0, contentid input is passed into showComments. The method showComments is defined in the expCommentControllercontroller with the parameter '$this-params'contentid'' used directly in SQL. Impact is a SQL injection...

CVE-2016-9481

In framework/modules/core/controllers/expCommentController.php of Exponent CMS 2.4.0, contentid input is passed into showComments. The method showComments is defined in the expCommentControllercontroller with the parameter '$this-params'contentid'' used directly in SQL. Impact is a SQL injection...

Sql injection

In framework/modules/core/controllers/expCommentController.php of Exponent CMS 2.4.0, contentid input is passed into showComments. The method showComments is defined in the expCommentControllercontroller with the parameter '$this-params'contentid'' used directly in SQL. Impact is a SQL injection...

CVE-2016-9481

In framework/modules/core/controllers/expCommentController.php of Exponent CMS 2.4.0, contentid input is passed into showComments. The method showComments is defined in the expCommentControllercontroller with the parameter '$this-params'contentid'' used directly in SQL. Impact is a SQL injection...

CVE-2016-9481

In framework/modules/core/controllers/expCommentController.php of Exponent CMS 2.4.0, contentid input is passed into showComments. The method showComments is defined in the expCommentControllercontroller with the parameter '$this-params'contentid'' used directly in SQL. Impact is a SQL injection...

CVE-2016-9481

Exponent CMS 2.4.0 contains a SQL injection vulnerability in framework/modules/core/controllers/expCommentController.php. The content_id parameter from showComments is derived from $this->params['content_id'] and is used directly in SQL without proper sanitization, enabling arbitrary SQL execu...

CVE-2016-9481: Improper Neutralization of Special Elements used in an SQL Command

In framework/modules/core/controllers/expCommentController.php of Exponent CMS 2.4.0, contentid input is passed into showComments. The method showComments is defined in the expCommentControllercontroller with the parameter '$this-params'contentid'' used directly in SQL. Impact is a SQL injection...

PT-2016-7766

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.4.0 Description The issue is related to a SQL injection problem. In the expCommentController.php file, the content id input is passed into the showComments method. This method uses the $this-params'content id' parameter...

Memory corruption

The mpipowm function in lib/mpi/mpi-pow.c in the Linux kernel through 4.8.11 does not ensure that memory is allocated for limb data, which allows local users to cause a denial of service stack memory corruption and panic via an addkey system call for an RSA key with a zero exponent...

UBUNTU-CVE-2016-8650

The mpipowm function in lib/mpi/mpi-pow.c in the Linux kernel through 4.8.11 does not ensure that memory is allocated for limb data, which allows local users to cause a denial of service stack memory corruption and panic via an addkey system call for an RSA key with a zero exponent...

PT-2016-7540 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.8.12 Description: The issue is related to the mpi powm function in the Linux kernel, which does not properly allocate memory for limb data. This can be exploited by local users to cause a denial of service,...

Exponent CMS <= 2.4.0 Information Disclosure and SQLi Vulnerabilities

Exponent CMS is prone to an SQL injection SQLi and an information disclosure vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE...

OIC Exponent CMS SQL Injection Vulnerability (CNVD-2016-11262)

OIC Exponent CMS is a free, open source modular content management system CMS based on PHP from the American OIC Group of companies. The system supports direct editing in the page, and provides user management, site configuration, content editing and other functions. An SQL injection vulnerabilit...

Sql injection

In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed into getSearchResults. The method getSearchResults is defined in the search model with the parameter '$term' used directly in SQL. Impact is a SQL injection...

CVE-2016-9287

In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed into getSearchResults. The method getSearchResults is defined in the search model with the parameter '$term' used directly in SQL. Impact is a SQL injection...

CVE-2016-9287

In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed into getSearchResults. The method getSearchResults is defined in the search model with the parameter '$term' used directly in SQL. Impact is a SQL injection...

CVE-2016-9287

In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed into getSearchResults. The method getSearchResults is defined in the search model with the parameter '$term' used directly in SQL. Impact is a SQL injection...

CVE-2016-9287

In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed into getSearchResults. The method getSearchResults is defined in the search model with the parameter '$term' used directly in SQL. Impact is a SQL injection...