CVE-2016-9481

In framework/modules/core/controllers/expCommentController.php of Exponent CMS 2.4.0, contentid input is passed into showComments. The method showComments is defined in the expCommentControllercontroller with the parameter '$this-params'contentid'' used directly in SQL. Impact is a SQL injection...

CVE-2016-9481

In framework/modules/core/controllers/expCommentController.php of Exponent CMS 2.4.0, contentid input is passed into showComments. The method showComments is defined in the expCommentControllercontroller with the parameter '$this-params'contentid'' used directly in SQL. Impact is a SQL injection...

Sql injection

In framework/modules/core/controllers/expCommentController.php of Exponent CMS 2.4.0, contentid input is passed into showComments. The method showComments is defined in the expCommentControllercontroller with the parameter '$this-params'contentid'' used directly in SQL. Impact is a SQL injection...

CVE-2016-9481

Exponent CMS 2.4.0 contains a SQL injection vulnerability in framework/modules/core/controllers/expCommentController.php. The content_id parameter from showComments is derived from $this->params['content_id'] and is used directly in SQL without proper sanitization, enabling arbitrary SQL execu...

CVE-2016-9481

In framework/modules/core/controllers/expCommentController.php of Exponent CMS 2.4.0, contentid input is passed into showComments. The method showComments is defined in the expCommentControllercontroller with the parameter '$this-params'contentid'' used directly in SQL. Impact is a SQL injection...

CVE-2016-9481

In framework/modules/core/controllers/expCommentController.php of Exponent CMS 2.4.0, contentid input is passed into showComments. The method showComments is defined in the expCommentControllercontroller with the parameter '$this-params'contentid'' used directly in SQL. Impact is a SQL injection...

PT-2016-7766

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.4.0 Description The issue is related to a SQL injection problem. In the expCommentController.php file, the content id input is passed into the showComments method. This method uses the $this-params'content id' parameter...

CVE-2016-9481: Improper Neutralization of Special Elements used in an SQL Command

In framework/modules/core/controllers/expCommentController.php of Exponent CMS 2.4.0, contentid input is passed into showComments. The method showComments is defined in the expCommentControllercontroller with the parameter '$this-params'contentid'' used directly in SQL. Impact is a SQL injection...

Exponent CMS <= 2.4.0 Information Disclosure and SQLi Vulnerabilities

Exponent CMS is prone to an SQL injection SQLi and an information disclosure vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE...

OIC Exponent CMS SQL Injection Vulnerability (CNVD-2016-11262)

OIC Exponent CMS is a free, open source modular content management system CMS based on PHP from the American OIC Group of companies. The system supports direct editing in the page, and provides user management, site configuration, content editing and other functions. An SQL injection vulnerabilit...

Sql injection

In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed into getSearchResults. The method getSearchResults is defined in the search model with the parameter '$term' used directly in SQL. Impact is a SQL injection...

CVE-2016-9287

In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed into getSearchResults. The method getSearchResults is defined in the search model with the parameter '$term' used directly in SQL. Impact is a SQL injection...

CVE-2016-9287

In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed into getSearchResults. The method getSearchResults is defined in the search model with the parameter '$term' used directly in SQL. Impact is a SQL injection...

CVE-2016-9287

In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed into getSearchResults. The method getSearchResults is defined in the search model with the parameter '$term' used directly in SQL. Impact is a SQL injection...

CVE-2016-9287

In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed into getSearchResults. The method getSearchResults is defined in the search model with the parameter '$term' used directly in SQL. Impact is a SQL injection...

CVE-2016-9287

The CVE-2016-9287 issue affects Exponent CMS 2.4.0 patch1, where untrusted input is passed from /framework/modules/notfound/controllers/notfoundController.php into getSearchResults and used directly in SQL in the search model. This unfiltered "$term" leads to a SQL injection vulnerability and pot...

CVE-2016-9287: Improper Neutralization of Special Elements used in an SQL Command

In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed into getSearchResults. The method getSearchResults is defined in the search model with the parameter '$term' used directly in SQL. Impact is a SQL injection...

PT-2016-7725

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.4.0 patch1 Description The issue arises from untrusted input being passed into the getSearchResults method in the /framework/modules/notfound/controllers/notfoundController.php file. This method, defined in the search...

OIC Exponent CMS SQL Injection Vulnerability (CNVD-2016-11170)

OIC Exponent CMS is a free, open source modular content management system CMS based on PHP from the American OIC Group of companies. The system supports direct editing in the page, and provides user management, site configuration, content editing and other functions. A SQL injection vulnerability...

OIC Exponent CMS SQL Injection Vulnerability (CNVD-2016-11166)

OIC Exponent CMS is a free, open source modular content management system CMS based on PHP from the American OIC Group of companies. The system supports direct editing in the page, and provides user management, site configuration, content editing and other functions. The 'DragnDropReRank' functio...