Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
exponentcms exponentcms vulnerabilities and exploits
(subscribe to this query)
7.5
CVSSv3
CVE-2016-9184
In /framework/modules/core/controllers/expHTMLEditorController.php of Exponent CMS 2.4.0, untrusted input is used to construct a table name, and in the selectObject method in mysqli class, table names are wrapped with a character that common filters do not filter, allowing for SQ...
Exponentcms Exponent Cms 2.4.0
8.8
CVSSv3
CVE-2016-9242
Multiple SQL injection vulnerabilities in the update method in framework/modules/core/controllers/expRatingController.php in Exponent CMS 2.4.0 allow remote authenticated users to execute arbitrary SQL commands via the (1) content_type or (2) subtype parameter.
Exponentcms Exponent Cms 2.4.0
7.5
CVSSv3
CVE-2016-9282
SQL Injection in framework/modules/search/controllers/searchController.php in Exponent CMS v2.4.0 allows remote malicious users to read database information via action=search&module=search with the search_string parameter.
Exponentcms Exponent Cms 2.4.0
5.3
CVSSv3
CVE-2016-9284
getUsersByJSON in framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0 allows remote malicious users to read user information via users/getUsersByJSON/sort/ and a trailing string.
Exponentcms Exponent Cms 2.4.0
5.3
CVSSv3
CVE-2016-9286
framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0patch1 does not properly restrict access to user records, which allows remote malicious users to read address information, as demonstrated by an address/show/id/1 URI.
Exponentcms Exponent Cms 2.4.0
9.8
CVSSv3
CVE-2016-9287
In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed into getSearchResults. The method getSearchResults is defined in the search model with the parameter '$term' used directly in SQL. Impact is a SQL i...
Exponentcms Exponent Cms 2.4.0
9.8
CVSSv3
CVE-2017-5879
An issue exists in Exponent CMS 2.4.1. This is a blind SQL injection that can be exploited by un-authenticated users via an HTTP GET request and which can be used to dump database data out to a malicious server, using an out-of-band technique, such as select_loadfile(). The vulne...
Exponentcms Exponent Cms 2.4.1
9.8
CVSSv3
CVE-2016-7565
install/index.php in Exponent CMS 2.3.9 allows remote malicious users to execute arbitrary commands via shell metacharacters in the sc array parameter.
Exponentcms Exponent Cms 2.3.9
9.8
CVSSv3
CVE-2016-7791
Exponent CMS 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload an evil 'exploit.tar.gz' file to the website, then extract it by visiting '/install/index.php?install_sample=../../files/exploit', which leads t...
Exponentcms Exponent Cms 2.3.9
9.8
CVSSv3
CVE-2016-7790
Exponent CMS 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload 'php' file to the website through uploader_paste.php, then overwrite /framework/conf/config.php, which leads to arbitrary code execution.
Exponentcms Exponent Cms 2.3.9
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-23316
SQL injection
type confusion
CVE-2024-20697
CVE-2024-4344
local
CVE-2024-30043
CVE-2024-3821
CVE-2024-5041
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
6