CVE-2016-7780

CVE-2016-7780 affects Exponent CMS up to version 2.3.9. The vulnerability is a SQL injection in cron/find_help.php where the version parameter can be controlled to execute arbitrary SQL commands. Mitigation/repair exists in the project; a fix is provided in the Exponent CMS repository (commit a8e...

CVE-2016-7782

CVE-2016-7782 is an SQL injection vulnerability in Exponent CMS 2.3.9 and earlier, exploitable via the src parameter in framework/core/models/expConfig.php. The connected sources indicate that $this->location_data can be controlled/injected, enabling time-based SQL injection and arbitrary SQL ...

CVE-2016-7784

Exponent CMS 2.3.9 and earlier is affected by a SQL injection in the getSection function (framework/core/subsystems/expRouter.php). This vulnerability allows remote attackers to inject arbitrary SQL via the section parameter. Public data in the CVE entry confirms the affected product/version and ...

CVE-2016-7781

Exponent CMS prior to 2.4.0 is affected by a SQL injection in the blog module: in blogController.php the author parameter is used unsafely. Root cause: $this->params['author'] is not escaped, enabling time-based blind SQL injection. A fix is available in the repository commit fdafb5ec97838e4ed...

CVE-2016-9087

CVE-2016-9087 affects Exponent CMS 2.3.9 and earlier, with a SQL injection vulnerability in framework/modules/filedownloads/controllers/filedownloadController.php via the fileid parameter. Multiple connected sources describe the vulnerability across CVSS metrics: CVSS v2 base 7.5 (P/C/I/A partial...

CVE-2016-7788

CVE-2016-7788 - Exponent CMS : A SQL injection in framework/modules/users/models/user.php affects Exponent CMS 2.3.9 and earlier, allowing remote attackers to execute arbitrary SQL via the username parameter. OpenVAS aggregates this under “Exponent CMS

CVE-2016-7789

Exponent CMS 2.3.9 and earlier is affected by a SQL injection in framework/core/models/expConfig.php, exploitable via the apikey parameter. The vulnerability allows remote attackers to execute arbitrary SQL commands; the NVD entry labels it high/critical with network access and no authentication ...

CVE-2016-7781

SQL injection vulnerability in framework/modules/blog/controllers/blogController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the author parameter...

CVE-2016-7782

SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the src parameter...

CVE-2016-7789

SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the apikey parameter...

CVE-2016-7788

SQL injection vulnerability in framework/modules/users/models/user.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2016-7783

SQL injection vulnerability in framework/core/models/expRecord.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the title parameter...

CVE-2016-9087: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in framework/modules/filedownloads/controllers/filedownloadController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the fileid parameter...

CVE-2016-7789: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the apikey parameter...

CVE-2016-7788: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in framework/modules/users/models/user.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2016-7782: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the src parameter...

CVE-2016-7783: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in framework/core/models/expRecord.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the title parameter...

CVE-2016-7780: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in cron/findhelp.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the version parameter...

CVE-2016-7784: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the getSection function in framework/core/subsystems/expRouter.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the section parameter...

CVE-2016-7781: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in framework/modules/blog/controllers/blogController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the author parameter...