OIC Exponent CMS SQL Injection Vulnerability (CNVD-2019-16532)

OIC Exponent CMS is a free, open source modular content management system CMS based on PHP from OIC, USA. The system supports direct editing in the page and provides user management, site configuration, content editing and other functions. A SQL injection vulnerability exists in the...

Exponent CMS Object Injection Vulnerability

OIC Exponent CMS is a free, open source, modular PHP-based content management system CMS from OIC USA. A security vulnerability exists in the framework/modules/core/controllers/expCatController.php file in Exponent CMS version 2.3.9. No details of the vulnerability are provided at this time...

Exponent CMS 2.4.1 Patch 5 - Privilege Escalation Vulnerability

Exponent CMS allows rogue admins to elevate their privileges. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

Exponent CMS 2.3.9 Multiple Vulnerabilities

ExponentCMS is prone to multiple vulnerabilities that have their source in the Pixidou Image Editor component. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifie...

Exponent CMS 2.3 Multiple File Upload Vulnerabilities

Exponent CMS 2.3 is prone to multiple vulnerabilities due to oversights in the file upload functionality. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Design/Logic Flaw

Exponent CMS 2.3.0 through 2.3.9 allows remote attackers to have unspecified impact via vectors related to "uploading files to wrong location."...

CVE-2016-7443

Exponent CMS 2.3.0 through 2.3.9 allows remote attackers to have unspecified impact via vectors related to "uploading files to wrong location."...

CVE-2016-7443

Exponent CMS 2.3.0 through 2.3.9 allows remote attackers to have unspecified impact via vectors related to "uploading files to wrong location."...

CVE-2016-7443

Exponent CMS 2.3.0 through 2.3.9 allows remote attackers to have unspecified impact via vectors related to "uploading files to wrong location."...

CVE-2016-7443

CVE-2016-7443 affects Exponent CMS, versions 2.3.0 to 2.3.9. The issue is a vulnerable file upload path that could allow a remote attacker to impact the system via uploading files to the wrong location. The vulnerability description is supported by multiple feeds and references, indicating a secu...

OIC Exponent CMS Elevation of Privilege Vulnerability

OIC Exponent CMS is a free, open source modular content management system CMS based on PHP from the American OIC Group of companies. The system supports direct editing in the page, and provides user management, site configuration, content editing and other functions. A security vulnerability exis...

CVE-2017-18213

In Exponent CMS before 2.4.1 Patch 6, certain admin users can elevate their privileges...

CVE-2017-18213

In Exponent CMS before 2.4.1 Patch 6, certain admin users can elevate their privileges...

Code injection

In Exponent CMS before 2.4.1 Patch 6, certain admin users can elevate their privileges...

CVE-2017-18213

In Exponent CMS before 2.4.1 Patch 6, certain admin users can elevate their privileges...

CVE-2017-18213

CVE-2017-18213 affects Exponent CMS prior to 2.4.1 Patch #6. The vulnerability allows certain admin users to elevate their privileges, constituting a privilege-escalation issue. The CVSS metrics in the provided sources indicate a high impact (CONFIDENTIALITY, INTEGRITY, and AVAILABILITY affected;...

The vulnerability of the install/index.php script of the Exponent CMS system allows a hacker to execute arbitrary code.

The vulnerability of the Exponent CMS content management system is related to improper handling of code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using the sc parameter in the install/index.php script...

CVE-2015-1177

Cross-site scripting XSS vulnerability in Exponent CMS 2.3.2...

Cross site scripting

Cross-site scripting XSS vulnerability in Exponent CMS 2.3.2...

CVE-2015-1177

Exponent CMS 2.3.2 is affected by a reflected cross-site scripting (XSS) vulnerability in index.php, exploitable via the src parameter in the search functionality. Technical details across sources show that an attacker can craft a URL containing malicious JavaScript (e.g., payloads like or onerr...