784 matches found
Code injection
In Exponent CMS before 2.4.1 Patch 6, certain admin users can elevate their privileges...
CVE-2017-18213
CVE-2017-18213 affects Exponent CMS prior to 2.4.1 Patch #6. The vulnerability allows certain admin users to elevate their privileges, constituting a privilege-escalation issue. The CVSS metrics in the provided sources indicate a high impact (CONFIDENTIALITY, INTEGRITY, and AVAILABILITY affected;...
CVE-2017-18213
In Exponent CMS before 2.4.1 Patch 6, certain admin users can elevate their privileges...
PT-2018-6741
Name of the Vulnerable Software and Affected Versions: Exponent CMS versions prior to 2.4.1 Patch 6 Description: The issue allows certain admin users to elevate their privileges. Recommendations: For versions prior to 2.4.1 Patch 6, update to version 2.4.1 Patch 6 or later to resolve the issue...
CVE-2017-18213: Undefined Security Weakness
In Exponent CMS before 2.4.1 Patch 6, certain admin users can elevate their privileges...
Exponent CMS install/index.php Code Execution
The vulnerability of the Exponent CMS content management system is related to improper handling of code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using the sc parameter in the install/index.php script...
CVE-2015-1177
Cross-site scripting XSS vulnerability in Exponent CMS 2.3.2...
Cross site scripting
Cross-site scripting XSS vulnerability in Exponent CMS 2.3.2...
CVE-2015-1177
Cross-site scripting XSS vulnerability in Exponent CMS 2.3.2...
CVE-2015-1177
Cross-site scripting XSS vulnerability in Exponent CMS 2.3.2...
CVE-2015-1177
Exponent CMS 2.3.2 is affected by a reflected cross-site scripting (XSS) vulnerability in index.php, exploitable via the src parameter in the search functionality. Technical details across sources show that an attacker can craft a URL containing malicious JavaScript (e.g., payloads like or onerr...
CVE-2015-1177: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in Exponent CMS 2.3.2...
PT-2017-6475
Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.3.2 Description A cross-site scripting XSS issue has been identified. XSS is a type of security vulnerability that can allow an attacker to inject malicious scripts into a website, potentially leading to unauthorized...
Exponent CMS eaasController.php api Function SQL Injection (CVE-2017-7991)
A SQL injection vulnerability has been reported in Exponent CMS. The vulnerability is due to a lack of input validation on the apikey HTTP parameter by the api function. A remote, unauthenticated user can exploit this vulnerability by sending a crafted HTTP request to the affected page...
Exponent CMS SQL Injection
SQL Injection vulnerability in Exponent CMS expCommentController.php contentid parameter Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...
Exponent CMS 2.3.9 LFI
Local file include vulnerability in Exponent CMS page parameter Vulnerability Type: Local File Include For the exploit source code contact DSquare Security sales team...
Exponent CMS Cross-Site Scripting Vulnerability (CNVD-2017-06734)
Exponent CMS is a free, open source, modular PHP-based content management system CMS. The system supports direct editing in the page and provides user management, site configuration, content editing and other functions. A cross-site scripting vulnerability exists in the...
Multiple SQL Injection Vulnerabilities in OIC Exponent CMS
OIC Exponent CMS is a free, open source modular content management system CMS based on PHP from the American OIC Group of companies. The system supports direct editing in the page, and provides user management, site configuration, content editing and other functions. Exponent CMS 2.4.1 version of...
