Exponentcms / Exponent Cms
59 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2021-47931 | Exponent CMS 2.6 Multiple Vulnerabilities Stored XSS Authentication | MEDIUM | 5.1 | May 10, 2026 |
| CVE-2021-32441 | SQL Injection vulnerability in Exponent-CMS v.2.6.0 fixed in 2.7.0 allows attackers to gain access to sensitive information via the selectValue function in the… | HIGH | 7.5 | Feb 17, 2023 |
| CVE-2022-23049 | Exponent CMS 2.6.0patch2 allows an authenticated user to inject persistent JavaScript code on the "User-Agent" header when logging in. When an administrator us… | MEDIUM | 5.4 | Feb 9, 2022 |
| CVE-2022-23048 | Exponent CMS 2.6.0patch2 allows an authenticated admin user to upload a malicious extension in the format of a ZIP file with a PHP file inside it. After upload… | HIGH | 7.2 | Feb 9, 2022 |
| CVE-2022-23047 | Exponent CMS 2.6.0patch2 allows an authenticated admin user to inject persistent JavaScript code inside the "Site/Organization Name","Site Title" and "Site Hea… | MEDIUM | 4.8 | Feb 9, 2022 |
| CVE-2016-9023 | Exponent CMS before 2.6.0 has improper input validation in cron/find_help.php. | CRITICAL | 9.8 | Dec 31, 2020 |
| CVE-2016-9026 | Exponent CMS before 2.6.0 has improper input validation in fileController.php. | CRITICAL | 9.8 | Dec 31, 2020 |
| CVE-2016-9025 | Exponent CMS before 2.6.0 has improper input validation in purchaseOrderController.php. | CRITICAL | 9.8 | Dec 31, 2020 |
| CVE-2016-9022 | Exponent CMS before 2.6.0 has improper input validation in usersController.php. | CRITICAL | 9.8 | Dec 31, 2020 |
| CVE-2016-9021 | Exponent CMS before 2.6.0 has improper input validation in storeController.php. | CRITICAL | 9.8 | Dec 31, 2020 |
| CVE-2016-8898 | Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/ecommerce/controllers/cartController.php. | CRITICAL | 9.8 | May 24, 2019 |
| CVE-2016-8900 | Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expTagController.php related to change_tags. | CRITICAL | 9.8 | May 24, 2019 |
| CVE-2016-8897 | Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/help/controllers/helpController.php. | CRITICAL | 9.8 | May 23, 2019 |
| CVE-2016-8899 | Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expCatController.php related to change_cats. | CRITICAL | 9.8 | May 23, 2019 |
| CVE-2016-7443 | Exponent CMS 2.3.0 through 2.3.9 allows remote attackers to have unspecified impact via vectors related to "uploading files to wrong location." | CRITICAL | 9.8 | Mar 6, 2018 |
| CVE-2017-18213 | In Exponent CMS before 2.4.1 Patch #6, certain admin users can elevate their privileges. | HIGH | 7.2 | Mar 4, 2018 |
| CVE-2015-1177 | Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.2. | MEDIUM | 6.1 | Aug 28, 2017 |
| CVE-2017-8085 | In Exponent CMS before 2.4.1 Patch #5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php. | MEDIUM | 6.1 | Apr 24, 2017 |
| CVE-2017-7991 | Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key (apikey parameter) in the api function of framework/modules/eaas/controllers/e… | CRITICAL | 9.8 | Apr 22, 2017 |
| CVE-2016-9087 | SQL injection vulnerability in framework/modules/filedownloads/controllers/filedownloadController.php in Exponent CMS 2.3.9 and earlier allows remote attackers… | CRITICAL | 9.8 | Mar 7, 2017 |
| CVE-2016-9020 | SQL injection vulnerability in framework/modules/help/controllers/helpController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbit… | CRITICAL | 9.8 | Mar 7, 2017 |
| CVE-2016-9019 | SQL injection vulnerability in the activate_address function in framework/modules/addressbook/controllers/addressController.php in Exponent CMS 2.3.9 and earli… | CRITICAL | 9.8 | Mar 7, 2017 |
| CVE-2016-7789 | SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands… | CRITICAL | 9.8 | Mar 7, 2017 |
| CVE-2016-7788 | SQL injection vulnerability in framework/modules/users/models/user.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL comma… | CRITICAL | 9.8 | Mar 7, 2017 |
| CVE-2016-7784 | SQL injection vulnerability in the getSection function in framework/core/subsystems/expRouter.php in Exponent CMS 2.3.9 and earlier allows remote attackers to… | CRITICAL | 9.8 | Mar 7, 2017 |
Showing 1 to 25 of 59 CVEs