CVE-2016-9135

Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/framework/modules/help/controllers/helpController.php" affecting the version parameter. Impact is Information Disclosure...

CVE-2016-7095

Exponent CMS before 2.3.9 is vulnerable to an attacker uploading a malicious script file using redirection to place the script in an unprotected folder, one allowing script execution...

CVE-2016-7095

Exponent CMS before 2.3.9 is vulnerable to an attacker uploading a malicious script file using redirection to place the script in an unprotected folder, one allowing script execution...

CVE-2016-7095

Exponent CMS prior to version 2.3.9 is vulnerable to an attacker uploading a malicious script file via redirection to place it in an unprotected folder that allows script execution. This affects Exponent CMS 2.3.x and earlier components handling file uploads; impact includes potential code execut...

CVE-2016-7453: Improper Neutralization of Special Elements used in an SQL Command

The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 could be used to perform an fid SQL Injection...

CVE-2016-7452: Unrestricted Upload of File with Dangerous Type

The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 could be used to upload a malicious file to any folder on the site via a cpi directory traversal...

CVE-2016-9134: Improper Neutralization of Special Elements used in an SQL Command

Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/expPaginator.php" affecting the order parameter. Impact is Information Disclosure...

PT-2016-7339

Name of the Vulnerable Software and Affected Versions Exponent CMS versions prior to 2.3.9 patch 2 Description The issue allows for SQL Injection. Recommendations For versions prior to 2.3.9 patch 2, update to version 2.3.9 patch 2 or later to resolve the issue...

PT-2016-7663

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.3.9 Description The issue affects the "/expPaginator.php" endpoint, specifically the order parameter, allowing for SQL injection. This can lead to information disclosure. Recommendations For Exponent CMS version 2.3.9,...

PT-2016-7338

Name of the Vulnerable Software and Affected Versions Exponent CMS versions prior to 2.3.9 patch 2 Description The issue allows an attacker to upload a malicious file to any folder on the site via a cpi directory traversal in the Pixidou Image Editor. Recommendations For versions prior to 2.3.9...

PT-2016-7664

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.3.9 Description The issue affects the "/framework/modules/help/controllers/helpController.php" file, specifically the version parameter, allowing for SQL injection. This can lead to information disclosure. Recommendation...

CVE-2016-9135: Improper Neutralization of Special Elements used in an SQL Command

Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/framework/modules/help/controllers/helpController.php" affecting the version parameter. Impact is Information Disclosure...

CVE-2016-7095: Unrestricted Upload of File with Dangerous Type

Exponent CMS before 2.3.9 is vulnerable to an attacker uploading a malicious script file using redirection to place the script in an unprotected folder, one allowing script execution...

PT-2016-7213

Name of the Vulnerable Software and Affected Versions Exponent CMS versions prior to 2.3.9 Description The issue allows an attacker to upload a malicious script file using redirection, placing the script in an unprotected folder that permits script execution. Recommendations For versions prior to...

Exponent CMS 2.3.9 SQL Injection Vulnerability

Exploit for php platform in category web applications Exponent CMS 2.3.9 SQL Injection Vulnerability Disclose 10 cve in Exponent CMS CVE-2016-7780 In the line 42 of cron/findhelp.php , $GET'version' can be controlled and injected. It is possible to time-based blind SQL Inject by the param of...

MatrixSSL pstm_exptmod Function Miscalculation Vulnerability

INSIDE Secure MatrixSSL is an embedded, open source SSLv3 stack from INSIDE Secure, France, designed for small applications and devices. The pstmexptmod in MatrixSSL inputs incorrect results for certain parameters, causing the associated cryptographic functions to fail to handle the private key...

Exponent CMS 2.3.9 Cross Site Scripting

======================================================================== | Title : Exponent CMS versions 2.3.9 XSS vulnerability | Author : indoushka | email : [email protected] | Tested on : windows 8.1 FranASSais V.Pro | Version : 2.3.9 | Vendor :...

Exponent CMS Local File Inclusion Vulnerability

Exponent CMS is a free, open source, modular PHP-based content management system. Exponent CMS suffers from a local file inclusion vulnerability that allows remote attackers to submit a specially crafted request to view the contents of system files with WEB privileges...

Exponent CMS Cross-Site Scripting Vulnerability (CNVD-2016-08139)

Exponent CMS is a free, open source, modular PHP-based content management system. Exponent CMS suffers from a cross-site scripting vulnerability that allows remote attackers to exploit the vulnerability to inject malicious script or HTML code, which can be used to obtain sensitive information or...

Exponent CMS Arbitrary Code Execution Vulnerability

Exponent CMS employs an intuitive and flexible content editing system that allows website pages to be edited on-page as it is displayed. An arbitrary code execution vulnerability exists in Exponent CMS due to a failure to properly validate user input. An attacker could exploit the vulnerability t...