Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
exponentcms exponentcms vulnerabilities and exploits
(subscribe to this query)
7.5
CVSSv2
CVE-2016-7095
Exponent CMS prior to 2.3.9 is vulnerable to an attacker uploading a malicious script file using redirection to place the script in an unprotected folder, one allowing script execution.
Exponentcms Exponent Cms
6.4
CVSSv2
CVE-2016-9272
A Blind SQL Injection Vulnerability in Exponent CMS up to and including 2.4.0, with the rerank array parameter, can lead to site database information disclosure and denial of service.
Exponentcms Exponent Cms
7.5
CVSSv2
CVE-2017-7991
Exponent CMS 2.4.1 and previous versions has SQL injection via a base64 serialized API key (apikey parameter) in the api function of framework/modules/eaas/controllers/eaasController.php.
Exponentcms Exponent Cms
4.3
CVSSv2
CVE-2010-5002
Cross-site scripting (XSS) vulnerability in modules/slideshowmodule/slideshow.js.php in Exponent CMS 0.97.0 allows remote malicious users to inject arbitrary web script or HTML via the u parameter.
Exponentcms Exponent Cms 0.97.0
1 EDB exploit
7.5
CVSSv2
CVE-2016-7791
Exponent CMS 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload an evil 'exploit.tar.gz' file to the website, then extract it by visiting '/install/index.php?install_sample=../../files/exploit', which leads t...
Exponentcms Exponent Cms 2.3.9
7.5
CVSSv2
CVE-2017-5879
An issue exists in Exponent CMS 2.4.1. This is a blind SQL injection that can be exploited by un-authenticated users via an HTTP GET request and which can be used to dump database data out to a malicious server, using an out-of-band technique, such as select_loadfile(). The vulne...
Exponentcms Exponent Cms 2.4.1
4.3
CVSSv2
CVE-2015-1177
Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.2.
Exponentcms Exponent Cms 2.3.2
5
CVSSv2
CVE-2016-9182
Exponent CMS 2.4 uses PHP reflection to call a method of a controller class, and then uses the method name to check user permission. But, the method name in PHP reflection is case insensitive, and Exponent CMS permits undefined actions to execute by default, so an attacker can us...
Exponentcms Exponent Cms 2.4.0
5
CVSSv2
CVE-2016-9183
In /framework/modules/ecommerce/controllers/orderController.php of Exponent CMS 2.4.0, untrusted input is passed into selectObjectsBySql. The method selectObjectsBySql of class mysqli_database uses the injectProof method to prevent SQL injection, but this filter can be bypassed e...
Exponentcms Exponent Cms 2.4.0
5
CVSSv2
CVE-2016-9284
getUsersByJSON in framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0 allows remote malicious users to read user information via users/getUsersByJSON/sort/ and a trailing string.
Exponentcms Exponent Cms 2.4.0
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
SSTI
CVE-2024-35863
CVE-2024-35910
man-in-the-middle
CVE-2024-35912
CVE-2024-25742
LFI
CVE-2024-32002
CVE-2024-22120
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
NEXT »