CVE-2016-2242

Exponent CMS 2.x before 2.3.7 Patch 3 allows remote attackers to execute arbitrary code via the sc parameter to install/index.php...

CVE-2016-2242

Exponent CMS 2.x before 2.3.7 Patch 3 is vulnerable to remote code execution via the sc parameter to install/index.php. The HTBridge advisory details that an unauthenticated attacker can inject PHP code into /framework/conf/config.php, gaining arbitrary command execution with the web server, and ...