Exponentcms vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2021-32441 SQL Injection vulnerability in Exponent-CMS v.2.6.0 fixed in 2.7.0 allows attackers to gain access to sensitive information via the selectValue function in the High 7.5 · Feb 17, 2023
• CVE-2022-23048 Exponent CMS 2.6.0patch2 allows an authenticated admin user to upload a malicious extension in the format of a ZIP file with a PHP file inside it.High 7.2 · Feb 9, 2022
• CVE-2016-9026 Exponent CMS before 2.6.0 has improper input validation in fileController.php.Critical 9.8 · Dec 30, 2020
• CVE-2016-9025 Exponent CMS before 2.6.0 has improper input validation in purchaseOrderController.php.Critical 9.8 · Dec 30, 2020
• CVE-2016-9023 Exponent CMS before 2.6.0 has improper input validation in cron/find_help.php.Critical 9.8 · Dec 30, 2020
• CVE-2016-9022 Exponent CMS before 2.6.0 has improper input validation in usersController.php.Critical 9.8 · Dec 30, 2020
• CVE-2016-9021 Exponent CMS before 2.6.0 has improper input validation in storeController.php.Critical 9.8 · Dec 30, 2020
• CVE-2016-8900 Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expTagController.php related to change_tags.Critical 9.8 · May 24, 2019
• CVE-2016-8898 Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/ecommerce/controllers/cartController.php.Critical 9.8 · May 24, 2019
• CVE-2016-8899 Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expCatController.php related to change_cats.Critical 9.8 · May 23, 2019
• CVE-2016-8897 Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/help/controllers/helpController.php.Critical 9.8 · May 23, 2019
• CVE-2016-7443 Exponent CMS 2.3.0 through 2.3.9 allows remote attackers to have unspecified impact via vectors related to "uploading files to wrong location."Critical 9.8 · Mar 6, 2018
• CVE-2017-18213 In Exponent CMS before 2.4.1 Patch #6, certain admin users can elevate their privileges.High 7.2 · Mar 3, 2018
• CVE-2017-7991 Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key (apikey parameter) in the api function of framework/modules/eaas/controllers/eaCritical 9.8 · Apr 21, 2017
• CVE-2016-9087 SQL injection vulnerability in framework/modules/filedownloads/controllers/filedownloadController.php in Exponent CMS 2.3.9 and earlier allows remote attackers Critical 9.8 · Mar 7, 2017
• CVE-2016-9020 SQL injection vulnerability in framework/modules/help/controllers/helpController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrCritical 9.8 · Mar 7, 2017
• CVE-2016-9019 SQL injection vulnerability in the activate_address function in framework/modules/addressbook/controllers/addressController.php in Exponent CMS 2.3.9 and earlieCritical 9.8 · Mar 7, 2017
• CVE-2016-7789 SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands vCritical 9.8 · Mar 7, 2017
• CVE-2016-7788 SQL injection vulnerability in framework/modules/users/models/user.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commanCritical 9.8 · Mar 7, 2017
• CVE-2016-7784 SQL injection vulnerability in the getSection function in framework/core/subsystems/expRouter.php in Exponent CMS 2.3.9 and earlier allows remote attackers to eCritical 9.8 · Mar 7, 2017
• CVE-2016-7783 SQL injection vulnerability in framework/core/models/expRecord.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands vCritical 9.8 · Mar 7, 2017
• CVE-2016-7782 SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands vCritical 9.8 · Mar 7, 2017
• CVE-2016-7781 SQL injection vulnerability in framework/modules/blog/controllers/blogController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrCritical 9.8 · Mar 7, 2017
• CVE-2016-7780 SQL injection vulnerability in cron/find_help.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the version paCritical 9.8 · Mar 7, 2017
• CVE-2016-7565 install/index.php in Exponent CMS 2.3.9 allows remote attackers to execute arbitrary commands via shell metacharacters in the sc array parameter.Critical 9.8 · Feb 13, 2017