Exponent CMS prior to 2.6.0 has improper input validation in cron/find_help.php.
exponentcms exponent cms