CVE-2016-9184

CVE-2016-9184 involves Exponent CMS 2.4.0. The issue occurs in /framework/modules/core/controllers/expHTMLEditorController.php where untrusted input is used to construct a table name, and in the mysqli-based selectObject method, table names are wrapped with a character not filtered by common tool...