Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ExponentcmsExponent Cms

32 matches found

CVE
CVE•added 2020/12/31 3:15 a.m.•66 views

CVE-2016-9022

Exponent CMS before 2.6.0 has improper input validation in usersController.php.

9.8CVSS9.4AI score0.00607EPSS
CVE
CVE•added 2020/12/31 3:15 a.m.•62 views

CVE-2016-9021

Exponent CMS before 2.6.0 has improper input validation in storeController.php.

9.8CVSS9.4AI score0.00607EPSS
CVE
CVE•added 2020/12/31 3:15 a.m.•62 views

CVE-2016-9025

Exponent CMS before 2.6.0 has improper input validation in purchaseOrderController.php.

9.8CVSS9.4AI score0.00607EPSS
CVE
CVE•added 2020/12/31 3:15 a.m.•62 views

CVE-2016-9026

Exponent CMS before 2.6.0 has improper input validation in fileController.php.

9.8CVSS9.4AI score0.00607EPSS
CVE
CVE•added 2020/12/31 3:15 a.m.•60 views

CVE-2016-9023

Exponent CMS before 2.6.0 has improper input validation in cron/find_help.php.

9.8CVSS9.4AI score0.00607EPSS
CVE
CVE•added 2017/02/07 3:59 p.m.•51 views

CVE-2016-7400

Multiple SQL injection vulnerabilities in Exponent CMS before 2.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an activate_address address controller action, (2) title parameter in a show blog controller action, or (3) content_id parameter in a showComments...

9.8CVSS10AI score0.18219EPSS
CVE
CVE•added 2017/02/06 3:59 p.m.•42 views

CVE-2017-5879

An issue was discovered in Exponent CMS 2.4.1. This is a blind SQL injection that can be exploited by un-authenticated users via an HTTP GET request and which can be used to dump database data out to a malicious server, using an out-of-band technique, such as select_loadfile(). The vulnerability af...

9.8CVSS9.7AI score0.00329EPSS
CVE
CVE•added 2019/05/24 5:29 p.m.•40 views

CVE-2016-8898

Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/ecommerce/controllers/cartController.php.

9.8CVSS9.5AI score0.00264EPSS
CVE
CVE•added 2019/05/23 7:29 p.m.•39 views

CVE-2016-8897

Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/help/controllers/helpController.php.

9.8CVSS9.5AI score0.00264EPSS
CVE
CVE•added 2016/11/03 10:59 a.m.•38 views

CVE-2016-7095

Exponent CMS before 2.3.9 is vulnerable to an attacker uploading a malicious script file using redirection to place the script in an unprotected folder, one allowing script execution.

9.8CVSS9.4AI score0.01203EPSS
CVE
CVE•added 2019/05/24 5:29 p.m.•38 views

CVE-2016-8900

Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expTagController.php related to change_tags.

9.8CVSS9.4AI score0.00513EPSS
CVE
CVE•added 2016/11/03 10:59 a.m.•37 views

CVE-2016-7453

The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 could be used to perform an fid SQL Injection.

9.8CVSS9.6AI score0.00532EPSS
CVE
CVE•added 2017/03/07 4:59 p.m.•37 views

CVE-2016-7780

SQL injection vulnerability in cron/find_help.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the version parameter.

9.8CVSS10AI score0.00587EPSS
CVE
CVE•added 2017/03/07 4:59 p.m.•37 views

CVE-2016-9087

SQL injection vulnerability in framework/modules/filedownloads/controllers/filedownloadController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the fileid parameter.

9.8CVSS10AI score0.02606EPSS
CVE
CVE•added 2017/03/07 4:59 p.m.•35 views

CVE-2016-7782

SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the src parameter.

9.8CVSS10AI score0.00587EPSS
CVE
CVE•added 2017/01/12 10:59 p.m.•35 views

CVE-2016-7790

Exponent CMS 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload 'php' file to the website through uploader_paste.php, then overwrite /framework/conf/config.php, which leads to arbitrary code execution.

9.8CVSS9.9AI score0.03525EPSS
CVE
CVE•added 2017/01/12 10:59 p.m.•35 views

CVE-2016-7791

Exponent CMS 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload an evil 'exploit.tar.gz' file to the website, then extract it by visiting '/install/index.php?install_sample=../../files/exploit', which leads to arbitrary code execution.

9.8CVSS9.9AI score0.03525EPSS
CVE
CVE•added 2019/05/23 7:29 p.m.•35 views

CVE-2016-8899

Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expCatController.php related to change_cats.

9.8CVSS9.4AI score0.00513EPSS
CVE
CVE•added 2017/03/07 4:59 p.m.•35 views

CVE-2016-9019

SQL injection vulnerability in the activate_address function in framework/modules/addressbook/controllers/addressController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the is_what parameter.

9.8CVSS10AI score0.00665EPSS
CVE
CVE•added 2017/04/22 1:59 a.m.•35 views

CVE-2017-7991

Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key (apikey parameter) in the api function of framework/modules/eaas/controllers/eaasController.php.

9.8CVSS9.8AI score0.01354EPSS
CVE
CVE•added 2017/03/07 4:59 p.m.•34 views

CVE-2016-7781

SQL injection vulnerability in framework/modules/blog/controllers/blogController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the author parameter.

9.8CVSS10AI score0.00587EPSS
CVE
CVE•added 2017/03/07 4:59 p.m.•34 views

CVE-2016-7783

SQL injection vulnerability in framework/core/models/expRecord.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the title parameter.

9.8CVSS10AI score0.00587EPSS
CVE
CVE•added 2017/03/07 4:59 p.m.•34 views

CVE-2016-9020

SQL injection vulnerability in framework/modules/help/controllers/helpController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the version parameter.

9.8CVSS10AI score0.00718EPSS
CVE
CVE•added 2018/03/07 2:29 a.m.•33 views

CVE-2016-7443

Exponent CMS 2.3.0 through 2.3.9 allows remote attackers to have unspecified impact via vectors related to "uploading files to wrong location."

9.8CVSS9.5AI score0.00932EPSS
CVE
CVE•added 2017/02/13 6:59 p.m.•33 views

CVE-2016-7565

install/index.php in Exponent CMS 2.3.9 allows remote attackers to execute arbitrary commands via shell metacharacters in the sc array parameter.

9.8CVSS9.8AI score0.01513EPSS
CVE
CVE•added 2017/03/07 4:59 p.m.•32 views

CVE-2016-7788

SQL injection vulnerability in framework/modules/users/models/user.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter.

9.8CVSS10AI score0.00587EPSS
CVE
CVE•added 2017/03/07 4:59 p.m.•31 views

CVE-2016-7789

SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the apikey parameter.

9.8CVSS10AI score0.00678EPSS
CVE
CVE•added 2016/11/15 11:59 a.m.•31 views

CVE-2016-9287

In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed into getSearchResults. The method getSearchResults is defined in the search model with the parameter '$term' used directly in SQL. Impact is a SQL injection.

9.8CVSS9.7AI score0.00532EPSS
CVE
CVE•added 2016/11/29 11:59 p.m.•31 views

CVE-2016-9481

In framework/modules/core/controllers/expCommentController.php of Exponent CMS 2.4.0, content_id input is passed into showComments. The method showComments is defined in the expCommentControllercontroller with the parameter '$this->params['content_id']' used directly in SQL. Impact is a SQL inje...

9.8CVSS9.8AI score0.00409EPSS
CVE
CVE•added 2016/11/11 11:59 p.m.•30 views

CVE-2016-9288

In framework/modules/navigation/controllers/navigationController.php in Exponent CMS v2.4.0 or older, the parameter "target" of function "DragnDropReRank" is directly used without any filtration which caused SQL injection. The payload can be used like this: /navigation/DragnDropReRank/target/1.

9.8CVSS9.8AI score0.00251EPSS
CVE
CVE•added 2017/03/07 4:59 p.m.•29 views

CVE-2016-7784

SQL injection vulnerability in the getSection function in framework/core/subsystems/expRouter.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the section parameter.

9.8CVSS10AI score0.00587EPSS
CVE
CVE•added 2016/11/11 11:59 a.m.•27 views

CVE-2016-9272

A Blind SQL Injection Vulnerability in Exponent CMS through 2.4.0, with the rerank array parameter, can lead to site database information disclosure and denial of service.

9.1CVSS9.1AI score0.00335EPSS