Sql injection

SQL injection vulnerability in framework/modules/help/controllers/helpController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the version parameter...

Sql injection

SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the src parameter...

Sql injection

SQL injection vulnerability in the activateaddress function in framework/modules/addressbook/controllers/addressController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the iswhat parameter...

Sql injection

SQL injection vulnerability in framework/modules/blog/controllers/blogController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the author parameter...

Sql injection

SQL injection vulnerability in framework/modules/filedownloads/controllers/filedownloadController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the fileid parameter...

Sql injection

SQL injection vulnerability in cron/findhelp.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the version parameter...

Sql injection

SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the apikey parameter...

Sql injection

SQL injection vulnerability in framework/modules/users/models/user.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter...

Sql injection

SQL injection vulnerability in framework/core/models/expRecord.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the title parameter...

CVE-2016-7784

SQL injection vulnerability in the getSection function in framework/core/subsystems/expRouter.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the section parameter...

CVE-2016-7789

SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the apikey parameter...

CVE-2016-7783

SQL injection vulnerability in framework/core/models/expRecord.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the title parameter...

CVE-2016-7780

SQL injection vulnerability in cron/findhelp.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the version parameter...

CVE-2016-9020

SQL injection vulnerability in framework/modules/help/controllers/helpController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the version parameter...

CVE-2016-9087

SQL injection vulnerability in framework/modules/filedownloads/controllers/filedownloadController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the fileid parameter...

CVE-2016-7789

Exponent CMS 2.3.9 and earlier is affected by a SQL injection in framework/core/models/expConfig.php, exploitable via the apikey parameter. The vulnerability allows remote attackers to execute arbitrary SQL commands; the NVD entry labels it high/critical with network access and no authentication ...

CVE-2016-7782

CVE-2016-7782 is an SQL injection vulnerability in Exponent CMS 2.3.9 and earlier, exploitable via the src parameter in framework/core/models/expConfig.php. The connected sources indicate that $this->location_data can be controlled/injected, enabling time-based SQL injection and arbitrary SQL ...

CVE-2016-9020

Summary of CVE-2016-9020 : Exponent CMS up to version 2.3.9 contains a SQL injection in the helpController.php (framework/modules/help/controllers/helpController.php) that allows an attacker to inject via the version parameter and potentially execute arbitrary SQL. Public sources (NVD/OpenVAS and...

CVE-2016-9019

CVE-2016-9019 describes a SQL injection in Exponent CMS up to version 2.3.9 in the activate_address function (framework/modules/addressbook/controllers/addressController.php) where the is_what parameter can be manipulated to execute arbitrary SQL. Public sources in the connected documents confirm...

CVE-2016-7784

Exponent CMS 2.3.9 and earlier is affected by a SQL injection in the getSection function (framework/core/subsystems/expRouter.php). This vulnerability allows remote attackers to inject arbitrary SQL via the section parameter. Public data in the CVE entry confirms the affected product/version and ...