CVE-2016-7452

Exponent CMS is affected by a directory traversal vulnerability in the Pixidou Image Editor component, tracked as CVE-2016-7452. The issue allows uploading a malicious file to any folder on the site via a cpi directory traversal vector, affecting Exponent CMS prior to v2.3.9 patch 2. The known re...

CVE-2016-7453

The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 could be used to perform an fid SQL Injection...

CVE-2016-7453

CVE-2016-7453 affects Exponent CMS prior to v2.3.9 patch 2, due to SQL injection in the Pixidou Image Editor component. The vulnerability arises from inadequate input filtering in the editor module, enabling an attacker to perform an SQL injection that could compromise the application and its dat...

CVE-2016-7453

The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 could be used to perform an fid SQL Injection...

CVE-2016-9134

Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/expPaginator.php" affecting the order parameter. Impact is Information Disclosure...

CVE-2016-9135

Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/framework/modules/help/controllers/helpController.php" affecting the version parameter. Impact is Information Disclosure...

CVE-2016-9134

Exponent CMS 2.3.9 suffers from a SQL injection in the file /expPaginator.php via the order parameter, leading to potential information disclosure. Documented across multiple sources (NVD, CNVD, OSV, CVE record). Root cause: unsafely interpolated input in a query. Impact: Information Disclosure. ...

CVE-2016-7095

Exponent CMS before 2.3.9 is vulnerable to an attacker uploading a malicious script file using redirection to place the script in an unprotected folder, one allowing script execution...

CVE-2016-7095

Exponent CMS prior to version 2.3.9 is vulnerable to an attacker uploading a malicious script file via redirection to place it in an unprotected folder that allows script execution. This affects Exponent CMS 2.3.x and earlier components handling file uploads; impact includes potential code execut...

CVE-2016-7095

Exponent CMS before 2.3.9 is vulnerable to an attacker uploading a malicious script file using redirection to place the script in an unprotected folder, one allowing script execution...

PT-2016-7338

Name of the Vulnerable Software and Affected Versions Exponent CMS versions prior to 2.3.9 patch 2 Description The issue allows an attacker to upload a malicious file to any folder on the site via a cpi directory traversal in the Pixidou Image Editor. Recommendations For versions prior to 2.3.9...

PT-2016-7664

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.3.9 Description The issue affects the "/framework/modules/help/controllers/helpController.php" file, specifically the version parameter, allowing for SQL injection. This can lead to information disclosure. Recommendation...

PT-2016-7339

Name of the Vulnerable Software and Affected Versions Exponent CMS versions prior to 2.3.9 patch 2 Description The issue allows for SQL Injection. Recommendations For versions prior to 2.3.9 patch 2, update to version 2.3.9 patch 2 or later to resolve the issue...

CVE-2016-7453: Improper Neutralization of Special Elements used in an SQL Command

The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 could be used to perform an fid SQL Injection...

PT-2016-7663

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.3.9 Description The issue affects the "/expPaginator.php" endpoint, specifically the order parameter, allowing for SQL injection. This can lead to information disclosure. Recommendations For Exponent CMS version 2.3.9,...

CVE-2016-9135: Improper Neutralization of Special Elements used in an SQL Command

Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/framework/modules/help/controllers/helpController.php" affecting the version parameter. Impact is Information Disclosure...

CVE-2016-9134: Improper Neutralization of Special Elements used in an SQL Command

Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/expPaginator.php" affecting the order parameter. Impact is Information Disclosure...

CVE-2016-7452: Unrestricted Upload of File with Dangerous Type

The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 could be used to upload a malicious file to any folder on the site via a cpi directory traversal...

CVE-2016-7095: Unrestricted Upload of File with Dangerous Type

Exponent CMS before 2.3.9 is vulnerable to an attacker uploading a malicious script file using redirection to place the script in an unprotected folder, one allowing script execution...

PT-2016-7213

Name of the Vulnerable Software and Affected Versions Exponent CMS versions prior to 2.3.9 Description The issue allows an attacker to upload a malicious script file using redirection, placing the script in an unprotected folder that permits script execution. Recommendations For versions prior to...