CVE-2017-8085

In Exponent CMS before 2.4.1 Patch 5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php...

CVE-2017-8085

In Exponent CMS before 2.4.1 Patch 5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php...

CVE-2017-8085

Exponent CMS vulnerable before 2.4.1 Patch #5 due to an XSS flaw in elFinder (framework/modules/file/connector/elfinder.php). The issue affects Exponent CMS versions prior to 2.4.1 Patch #5; patch 2.4.1 Patch #5 fixes the vulnerability. The connected sources describe the vulnerability as a cross-...

CVE-2017-8085

In Exponent CMS before 2.4.1 Patch 5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php...

PT-2017-18111

Name of the Vulnerable Software and Affected Versions Exponent CMS versions prior to 2.4.1 Patch 5 Description The issue allows for XSS in elFinder, which is located in framework/modules/file/connector/elfinder.php. Recommendations For versions prior to 2.4.1 Patch 5, update to version 2.4.1 Patc...

CVE-2017-8085: Improper Neutralization of Input During Web Page Generation

In Exponent CMS before 2.4.1 Patch 5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php...

CVE-2017-7991

Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key apikey parameter in the api function of framework/modules/eaas/controllers/eaasController.php...

CVE-2017-7991

Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key apikey parameter in the api function of framework/modules/eaas/controllers/eaasController.php...

Sql injection

Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key apikey parameter in the api function of framework/modules/eaas/controllers/eaasController.php...

CVE-2017-7991

Exponent CMS 2.4.1 and earlier is affected by a SQL injection in the api() function of framework/modules/eaas/controllers/eaasController.php. The root cause is lack of input validation on the apikey parameter, which is base64-encoded, URL-decoded, and unserialized (via expUnserialize) before furt...

CVE-2017-7991

Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key apikey parameter in the api function of framework/modules/eaas/controllers/eaasController.php...

CVE-2017-7991

Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key apikey parameter in the api function of framework/modules/eaas/controllers/eaasController.php...

PT-2017-18053

Name of the Vulnerable Software and Affected Versions Exponent CMS versions 2.4.1 and earlier Description The issue concerns a SQL injection vulnerability. It occurs via a base64 serialized API key in the apikey parameter within the api function of...

CVE-2017-7991: Improper Neutralization of Special Elements used in an SQL Command

Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key apikey parameter in the api function of framework/modules/eaas/controllers/eaasController.php...

Exponent CMS 2.4.1 SQL Injection

CVE-2017-7991-SQL injection-Exponent CMS Suggested description Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key apikey parameter in the api function of framework/modules/eaas/controllers/eaasController.php. ------------------------------------------ Additional...

Exponent CMS 2.4.1 SQL Injection Vulnerability

Exponent CMS versions 2.4.1 and below suffer from a remote SQL injection vulnerability. CVE-2017-7991-SQL injection-Exponent CMS Suggested description Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key apikey parameter in the api function of...

Exponent CMS < 2.4.0 Multiple SQLi and RCE Vulnerabilities

Exponent CMS is prone to multiple SQL injection SQLi and remote code execution RCE vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CVE-2016-7789

SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the apikey parameter...

CVE-2016-9020

SQL injection vulnerability in framework/modules/help/controllers/helpController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the version parameter...

CVE-2016-9087

SQL injection vulnerability in framework/modules/filedownloads/controllers/filedownloadController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the fileid parameter...