Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
exponentcms exponent cms vulnerabilities and exploits
(subscribe to this query)
445
VMScore
CVE-2016-9182
Exponent CMS 2.4 uses PHP reflection to call a method of a controller class, and then uses the method name to check user permission. But, the method name in PHP reflection is case insensitive, and Exponent CMS permits undefined actions to execute by default, so an attacker can us...
Exponentcms Exponent Cms 2.4.0
445
VMScore
CVE-2016-9184
In /framework/modules/core/controllers/expHTMLEditorController.php of Exponent CMS 2.4.0, untrusted input is used to construct a table name, and in the selectObject method in mysqli class, table names are wrapped with a character that common filters do not filter, allowing for SQ...
Exponentcms Exponent Cms 2.4.0
578
VMScore
CVE-2016-9242
Multiple SQL injection vulnerabilities in the update method in framework/modules/core/controllers/expRatingController.php in Exponent CMS 2.4.0 allow remote authenticated users to execute arbitrary SQL commands via the (1) content_type or (2) subtype parameter.
Exponentcms Exponent Cms 2.4.0
445
VMScore
CVE-2016-9283
SQL Injection in framework/core/subsystems/expRouter.php in Exponent CMS v2.4.0 allows remote malicious users to read database information via address/addContentToSearch/id/ and a trailing string, related to a "sef URL" issue.
Exponentcms Exponent Cms 2.4.0
383
VMScore
CVE-2014-6635
Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.0 allows remote malicious users to inject arbitrary web script or HTML via the src parameter in the search action to index.php.
Exponentcms Exponent Cms 2.3.0
668
VMScore
CVE-2016-8897
Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/help/controllers/helpController.php.
Exponentcms Exponent Cms 2.3.9
445
VMScore
CVE-2016-9285
framework/modules/addressbook/controllers/addressController.php in Exponent CMS v2.4.0 allows remote malicious users to read user information via a modified id number, as demonstrated by address/edit/id/1, related to an "addresses, countries, and regions" issue.
Exponentcms Exponent Cms 2.4.0
445
VMScore
CVE-2016-9134
Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/expPaginator.php" affecting the order parameter. Impact is Information Disclosure.
Exponentcms Exponent Cms 2.3.9
580
VMScore
CVE-2022-23048
Exponent CMS 2.6.0patch2 allows an authenticated admin user to upload a malicious extension in the format of a ZIP file with a PHP file inside it. After upload it, the PHP file will be placed at "themes/simpletheme/{rce}.php" from where can be accessed in order to execu...
Exponentcms Exponent Cms 2.6.0
668
VMScore
CVE-2016-7565
install/index.php in Exponent CMS 2.3.9 allows remote malicious users to execute arbitrary commands via shell metacharacters in the sc array parameter.
Exponentcms Exponent Cms 2.3.9
VMScore
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-4367
CVE-2024-35977
CVE-2023-49335
man-in-the-middle
CVE-2024-4947
CVE-2024-31714
memory leak
SQL
CVE-2024-35994
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6
NEXT »