CVE-2016-9288

CVE-2016-9288 affects Exponent CMS v2.4.0 or older, where the parameter target in DragnDropReRank is used without filtration in framework/modules/navigation/controllers/navigationController.php, enabling SQL injection. The vulnerability is described consistently across sources (NVD entry and CNVD...