CVE-2016-7784: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the getSection function in framework/core/subsystems/expRouter.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the section parameter...

PT-2017-9341

Name of the Vulnerable Software and Affected Versions Exponent CMS versions 2.3.9 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the section parameter in the getSection function, located in the expRouter.php file within the...

OIC Exponent CMS SQL Injection Vulnerability (CNVD-2016-11170)

OIC Exponent CMS is a free, open source modular content management system CMS based on PHP from the American OIC Group of companies. The system supports direct editing in the page, and provides user management, site configuration, content editing and other functions. A SQL injection vulnerability...

CVE-2016-9283

SQL Injection in framework/core/subsystems/expRouter.php in Exponent CMS v2.4.0 allows remote attackers to read database information via address/addContentToSearch/id/ and a trailing string, related to a "sef URL" issue...

CVE-2016-9283: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection in framework/core/subsystems/expRouter.php in Exponent CMS v2.4.0 allows remote attackers to read database information via address/addContentToSearch/id/ and a trailing string, related to a "sef URL" issue...