CVE-2016-9287

In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed into getSearchResults. The method getSearchResults is defined in the search model with the parameter '$term' used directly in SQL. Impact is a SQL injection...

PT-2016-7725

Name of the Vulnerable Software and Affected Versions Exponent CMS version 2.4.0 patch1 Description The issue arises from untrusted input being passed into the getSearchResults method in the /framework/modules/notfound/controllers/notfoundController.php file. This method, defined in the search...

CVE-2016-9287: Improper Neutralization of Special Elements used in an SQL Command

In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed into getSearchResults. The method getSearchResults is defined in the search model with the parameter '$term' used directly in SQL. Impact is a SQL injection...