CVE-2016-9020

SQL injection vulnerability in framework/modules/help/controllers/helpController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the version parameter...

CVE-2016-9020

SQL injection vulnerability in framework/modules/help/controllers/helpController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the version parameter...

CVE-2016-7789

SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the apikey parameter...

CVE-2016-7784

SQL injection vulnerability in the getSection function in framework/core/subsystems/expRouter.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the section parameter...

CVE-2016-7781

SQL injection vulnerability in framework/modules/blog/controllers/blogController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the author parameter...

CVE-2016-7788

SQL injection vulnerability in framework/modules/users/models/user.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2016-7781

SQL injection vulnerability in framework/modules/blog/controllers/blogController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the author parameter...

CVE-2016-7781

Exponent CMS prior to 2.4.0 is affected by a SQL injection in the blog module: in blogController.php the author parameter is used unsafely. Root cause: $this->params['author'] is not escaped, enabling time-based blind SQL injection. A fix is available in the repository commit fdafb5ec97838e4ed...

CVE-2016-7789

Exponent CMS 2.3.9 and earlier is affected by a SQL injection in framework/core/models/expConfig.php, exploitable via the apikey parameter. The vulnerability allows remote attackers to execute arbitrary SQL commands; the NVD entry labels it high/critical with network access and no authentication ...

CVE-2016-7780

CVE-2016-7780 affects Exponent CMS up to version 2.3.9. The vulnerability is a SQL injection in cron/find_help.php where the version parameter can be controlled to execute arbitrary SQL commands. Mitigation/repair exists in the project; a fix is provided in the Exponent CMS repository (commit a8e...

CVE-2016-9087

CVE-2016-9087 affects Exponent CMS 2.3.9 and earlier, with a SQL injection vulnerability in framework/modules/filedownloads/controllers/filedownloadController.php via the fileid parameter. Multiple connected sources describe the vulnerability across CVSS metrics: CVSS v2 base 7.5 (P/C/I/A partial...

CVE-2016-7782

CVE-2016-7782 is an SQL injection vulnerability in Exponent CMS 2.3.9 and earlier, exploitable via the src parameter in framework/core/models/expConfig.php. The connected sources indicate that $this->location_data can be controlled/injected, enabling time-based SQL injection and arbitrary SQL ...

CVE-2016-9020

Summary of CVE-2016-9020 : Exponent CMS up to version 2.3.9 contains a SQL injection in the helpController.php (framework/modules/help/controllers/helpController.php) that allows an attacker to inject via the version parameter and potentially execute arbitrary SQL. Public sources (NVD/OpenVAS and...

CVE-2016-7783

CVE-2016-7783 is a SQL injection vulnerability affecting Exponent CMS 2.3.9 and earlier, exploitable via the title parameter in framework/core/models/expRecord.php. The issue allows remote attackers to execute arbitrary SQL commands. In NVD, the CVSS2 base score is 7.5 (HIGH) and the CVSS3 vector...

CVE-2016-9019

CVE-2016-9019 describes a SQL injection in Exponent CMS up to version 2.3.9 in the activate_address function (framework/modules/addressbook/controllers/addressController.php) where the is_what parameter can be manipulated to execute arbitrary SQL. Public sources in the connected documents confirm...

CVE-2016-7788

CVE-2016-7788 - Exponent CMS : A SQL injection in framework/modules/users/models/user.php affects Exponent CMS 2.3.9 and earlier, allowing remote attackers to execute arbitrary SQL via the username parameter. OpenVAS aggregates this under “Exponent CMS

CVE-2016-7788

SQL injection vulnerability in framework/modules/users/models/user.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter...

PT-2017-9344

Name of the Vulnerable Software and Affected Versions Exponent CMS versions 2.3.9 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the apikey parameter. Recommendations For Exponent CMS versions 2.3.9 and earlier, update to a versio...

CVE-2016-7784: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the getSection function in framework/core/subsystems/expRouter.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the section parameter...

PT-2017-9929

Name of the Vulnerable Software and Affected Versions Exponent CMS versions 2.3.9 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the is what parameter in the activate address function. Recommendations For Exponent CMS versions 2.3...