785 matches found
CVE-2026-108900
A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be use...
CVE-2026-108900
A SQL injection vulnerability exists in Exponent CMS up to version 3.0.2patch2 . The flaw is located within the userLogin function of the xmlrpc.php file in the XML-RPC component. This vulnerability allows for remote execution of unauthorized SQL commands. While the exploit has been disclosed to ...
CVE-2026-108900 Exponent CMS XML-RPC xmlrpc.php userLogin sql injection
A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be use...
EUVD-2026-97502
A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be use...
PT-2026-110634
Name of the Vulnerable Software and Affected Versions Exponent CMS versions prior to 3.0.2patch3 Description An issue exists in the XML-RPC component within the userLogin function of the xmlrpc.php file. This flaw allows a remote attacker to perform SQL injection, which is a technique used to...
CVE-2026-108900: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be use...
CVE-2021-47931
Exponent CMS 2.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the Title and Text Block parameters in the text editing endpoint. Attackers can inject iframe payloads with embedded SVG onload events to execute arbitrary...
CVE-2021-47931
Exponent CMS 2.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the Title and Text Block parameters in the text editing endpoint. Attackers can inject iframe payloads with embedded SVG onload events to execute arbitrary...
CVE-2021-47931 Exponent CMS 2.6 Multiple Vulnerabilities Stored XSS Authentication
Exponent CMS 2.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the Title and Text Block parameters in the text editing endpoint. Attackers can inject iframe payloads with embedded SVG onload events to execute arbitrary...
CVE-2021-47931 Exponent CMS 2.6 Multiple Vulnerabilities Stored XSS Authentication
Exponent CMS 2.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the Title and Text Block parameters in the text editing endpoint. Attackers can inject iframe payloads with embedded SVG onload events to execute arbitrary...
CVE-2021-47931
Exponent CMS 2.6 is affected by a stored cross-site scripting (XSS) vulnerability in the text editing endpoint, exploitable via Title and Text Block parameters. Attackers with authentication can inject scripts (e.g., iframe payloads with embedded SVG onload events) to run arbitrary JavaScript. Th...
Exponent CMS cross-site scripting vulnerability
Exponent CMS is a website content management system provided by the Exponent company, offering capabilities for page management and modular content editing. Version 2.6 of Exponent CMS contains a cross-site scripting vulnerability. This vulnerability stems from storage-based cross-site scripting...
CVE-2021-47931: Improper Neutralization of Input During Web Page Generation
Exponent CMS 2.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the Title and Text Block parameters in the text editing endpoint. Attackers can inject iframe payloads with embedded SVG onload events to execute arbitrary...
Exploit for Cross-site Scripting in Exponentcms Exponent_Cms
Synthetic Test Case: CVE-2017-8085 CWE: CWE-79 Origin...
CVE-2016-9021
Exponent CMS before 2.6.0 has improper input validation in storeController.php...
CVE-2016-9025
Exponent CMS before 2.6.0 has improper input validation in purchaseOrderController.php...
CVE-2016-9022
Exponent CMS before 2.6.0 has improper input validation in usersController.php...
CVE-2016-9026
Exponent CMS before 2.6.0 has improper input validation in fileController.php...
CVE-2022-23047
Exponent CMS 2.6.0patch2 allows an authenticated admin user to inject persistent JavaScript code inside the "Site/Organization Name","Site Title" and "Site Header" parameters while updating the site settings on "/exponentcms/administration/configuresite"...