CVE-2015-1177

Exponent CMS 2.3.2 is affected by a reflected cross-site scripting (XSS) vulnerability in index.php, exploitable via the src parameter in the search functionality. Technical details across sources show that an attacker can craft a URL containing malicious JavaScript (e.g., payloads like or onerr...

CVE-2016-7452

Exponent CMS is affected by a directory traversal vulnerability in the Pixidou Image Editor component, tracked as CVE-2016-7452. The issue allows uploading a malicious file to any folder on the site via a cpi directory traversal vector, affecting Exponent CMS prior to v2.3.9 patch 2. The known re...

CVE-2016-7565

Summary: CVE-2016-7565 affects Exponent CMS, specifically install/index.php in version 2.3.9, where remote command execution is possible via shell metacharacters in the sc array parameter. The vulnerability’s root cause is improper handling of shell metacharacters, enabling an attacker to execute...

CVE-2016-9135

Exponent CMS 2.3.9 is affected by a SQL injection in /framework/modules/help/controllers/helpController.php (version parameter). Root cause: improper handling of the version parameter leading to information disclosure. Evidence across NVD/CNVD/OSVLINE shows the same vulnerability; exploitation de...

CVE-2016-9287

The CVE-2016-9287 issue affects Exponent CMS 2.4.0 patch1, where untrusted input is passed from /framework/modules/notfound/controllers/notfoundController.php into getSearchResults and used directly in SQL in the search model. This unfiltered "$term" leads to a SQL injection vulnerability and pot...

CVE-2016-9184

CVE-2016-9184 involves Exponent CMS 2.4.0. The issue occurs in /framework/modules/core/controllers/expHTMLEditorController.php where untrusted input is used to construct a table name, and in the mysqli-based selectObject method, table names are wrapped with a character not filtered by common tool...

CVE-2014-6635

CVE-2014-6635 affects Exponent CMS 2.3.0, exposing a cross-site scripting (XSS) flaw in the src parameter of the search action to index.php. The vulnerability allows remote attackers to inject arbitrary web script or HTML. CVSS v2 base score is 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N). Exploitation statu...

CVE-2016-9242

Exponent CMS 2.4.0 is affected by multiple SQL injection vulnerabilities in the update method of framework/modules/core/controllers/expRatingController.php. The issues allow remote authenticated users to execute arbitrary SQL commands via the content_type or subtype parameters. Impact is describe...

CVE-2016-7784

Exponent CMS 2.3.9 and earlier is affected by a SQL injection in the getSection function (framework/core/subsystems/expRouter.php). This vulnerability allows remote attackers to inject arbitrary SQL via the section parameter. Public data in the CVE entry confirms the affected product/version and ...