Known Vulnerabilities for products from Exponentcms
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Exponentcms".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2022-23049 json | Exponent CMS 2.6.0patch2 allows an authenticated user to inject persistent JavaScript code on the "User-Agent" header when lo... | 5.4 - MEDIUM | 2022-02-09 | 2022-02-17 |
| CVE-2022-23048 json | Exponent CMS 2.6.0patch2 allows an authenticated admin user to upload a malicious extension in the format of a ZIP file with ... | 7.2 - HIGH | 2022-02-09 | 2022-02-17 |
| CVE-2022-23047 json | Exponent CMS 2.6.0patch2 allows an authenticated admin user to inject persistent JavaScript code inside the "Site/Organizatio... | 4.8 - MEDIUM | 2022-02-09 | 2022-02-16 |
| CVE-2021-38751 json | A HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponent_constants.php. A modified HTTP header can change l... | 4.3 - MEDIUM | 2021-08-16 | 2021-08-23 |
| CVE-2021-32441 json | ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new secur... | 7.5 - HIGH | 2023-02-17 | 2023-02-28 |
| CVE-2017-18213 json | In Exponent CMS before 2.4.1 Patch #6, certain admin users can elevate their privileges. | 7.2 - HIGH | 2018-03-04 | 2019-10-03 |
| CVE-2017-8085 json | In Exponent CMS before 2.4.1 Patch #5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php. | Not Provided | 2017-04-24 | 2025-04-20 |
| CVE-2017-7991 json | Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key (apikey parameter) in the api function of fr... | Not Provided | 2017-04-22 | 2025-04-20 |
| CVE-2017-5879 json | An issue was discovered in Exponent CMS 2.4.1. This is a blind SQL injection that can be exploited by un-authenticated users ... | 9.8 - CRITICAL | 2017-02-06 | 2017-02-08 |
| CVE-2016-9481 json | In framework/modules/core/controllers/expCommentController.php of Exponent CMS 2.4.0, content_id input is passed into showCom... | Not Provided | 2016-11-29 | 2026-05-06 |
| CVE-2016-9288 json | In framework/modules/navigation/controllers/navigationController.php in Exponent CMS v2.4.0 or older, the parameter "target" ... | Not Provided | 2016-11-11 | 2026-05-06 |
| CVE-2016-9287 json | In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed int... | Not Provided | 2016-11-15 | 2026-05-06 |
| CVE-2016-9286 json | framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0patch1 does not properly restrict access to use... | Not Provided | 2016-11-11 | 2026-05-06 |
| CVE-2016-9285 json | framework/modules/addressbook/controllers/addressController.php in Exponent CMS v2.4.0 allows remote attackers to read user i... | Not Provided | 2016-11-11 | 2026-05-06 |
| CVE-2016-9284 json | getUsersByJSON in framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0 allows remote attackers to r... | Not Provided | 2016-11-11 | 2026-05-06 |
| CVE-2016-9283 json | SQL Injection in framework/core/subsystems/expRouter.php in Exponent CMS v2.4.0 allows remote attackers to read database info... | Not Provided | 2016-11-11 | 2026-05-06 |
| CVE-2016-9282 json | SQL Injection in framework/modules/search/controllers/searchController.php in Exponent CMS v2.4.0 allows remote attackers to ... | Not Provided | 2016-11-11 | 2026-05-06 |
| CVE-2016-9272 json | A Blind SQL Injection Vulnerability in Exponent CMS through 2.4.0, with the rerank array parameter, can lead to site database... | Not Provided | 2016-11-11 | 2026-05-06 |
| CVE-2016-9242 json | Multiple SQL injection vulnerabilities in the update method in framework/modules/core/controllers/expRatingController.php in ... | Not Provided | 2016-11-07 | 2026-05-06 |
| CVE-2016-9184 json | In /framework/modules/core/controllers/expHTMLEditorController.php of Exponent CMS 2.4.0, untrusted input is used to construc... | Not Provided | 2016-11-04 | 2026-05-06 |
Known software with vulnerabilities from Exponentcms
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Exponentcms | Exponent Cms | 0.97.0 |