CVE-2016-9272

Exponent CMS before version 2.4.0 contains a blind SQL injection via the rerank array parameter that can lead to partial database information disclosure and denial of service. This is documented across CVE-2016-9272 entries (NVD, CNVD/OSV). The core issue is an injectable parameter in the rerank ...