Exponentcms - vulnerabilities (CVEs)

61 CVEs in 2 products, 0 in the last 30 days, newest from 2026-05-10.

Products

• Exponent Cms - 60 CVEs
• Exponentcms - 1 CVEs

Newest CVEs of Exponentcms

• CVE-2021-47931 - CVSS 6.4 (medium), 2026-05-10: Exponent CMS 2.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the Title and…
• CVE-2021-32441 - CVSS 7.5 (high), 2023-02-17: SQL Injection vulnerability in Exponent-CMS v.2.6.0 fixed in 2.7.0 allows attackers to gain access to sensitive information via the selectValue function in…
• CVE-2022-23049 - CVSS 5.4 (medium), 2022-02-09: Exponent CMS 2.6.0patch2 allows an authenticated user to inject persistent JavaScript code on the "User-Agent" header when logging in. When an administrator…
• CVE-2022-23048 - CVSS 7.2 (high), 2022-02-09: Exponent CMS 2.6.0patch2 allows an authenticated admin user to upload a malicious extension in the format of a ZIP file with a PHP file inside it. After…
• CVE-2022-23047 - CVSS 4.8 (medium), 2022-02-09: Exponent CMS 2.6.0patch2 allows an authenticated admin user to inject persistent JavaScript code inside the "Site/Organization Name","Site Title" and "Site…
• CVE-2021-38751 - CVSS 4.3 (medium), 2021-08-16: A HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponent_constants.php. A modified HTTP header can change links on the webpage to an…
• CVE-2016-9022 - CVSS 9.8 (critical), 2020-12-31: Exponent CMS before 2.6.0 has improper input validation in usersController.php.
• CVE-2016-9026 - CVSS 9.8 (critical), 2020-12-31: Exponent CMS before 2.6.0 has improper input validation in fileController.php.
• CVE-2016-9021 - CVSS 9.8 (critical), 2020-12-31: Exponent CMS before 2.6.0 has improper input validation in storeController.php.
• CVE-2016-9025 - CVSS 9.8 (critical), 2020-12-31: Exponent CMS before 2.6.0 has improper input validation in purchaseOrderController.php.
• CVE-2016-9023 - CVSS 9.8 (critical), 2020-12-31: Exponent CMS before 2.6.0 has improper input validation in cron/find_help.php.
• CVE-2016-8900 - CVSS 9.8 (critical), 2019-05-24: Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expTagController.php related to change_tags.
• CVE-2016-8898 - CVSS 9.8 (critical), 2019-05-24: Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/ecommerce/controllers/cartController.php.
• CVE-2016-8899 - CVSS 9.8 (critical), 2019-05-23: Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expCatController.php related to change_cats.
• CVE-2016-8897 - CVSS 9.8 (critical), 2019-05-23: Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/help/controllers/helpController.php.
• CVE-2016-7443 - CVSS 9.8 (critical), 2018-03-07: Exponent CMS 2.3.0 through 2.3.9 allows remote attackers to have unspecified impact via vectors related to "uploading files to wrong location."
• CVE-2017-18213 - CVSS 7.2 (high), 2018-03-04: In Exponent CMS before 2.4.1 Patch #6, certain admin users can elevate their privileges.
• CVE-2015-1177 - CVSS 6.1 (medium), 2017-08-28: Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.2.
• CVE-2017-8085 - CVSS 6.1 (medium), 2017-04-24: In Exponent CMS before 2.4.1 Patch #5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php.
• CVE-2017-7991 - CVSS 9.8 (critical), 2017-04-22: Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key (apikey parameter) in the api function of…
• CVE-2016-7784 - CVSS 9.8 (critical), 2017-03-07: SQL injection vulnerability in the getSection function in framework/core/subsystems/expRouter.php in Exponent CMS 2.3.9 and earlier allows remote attackers to…
• CVE-2016-9019 - CVSS 9.8 (critical), 2017-03-07: SQL injection vulnerability in the activate_address function in framework/modules/addressbook/controllers/addressController.php in Exponent CMS 2.3.9 and…
• CVE-2016-7780 - CVSS 9.8 (critical), 2017-03-07: SQL injection vulnerability in cron/find_help.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the version…
• CVE-2016-7783 - CVSS 9.8 (critical), 2017-03-07: SQL injection vulnerability in framework/core/models/expRecord.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands…
• CVE-2016-7789 - CVSS 9.8 (critical), 2017-03-07: SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands…
• CVE-2016-9087 - CVSS 9.8 (critical), 2017-03-07: SQL injection vulnerability in framework/modules/filedownloads/controllers/filedownloadController.php in Exponent CMS 2.3.9 and earlier allows remote…
• CVE-2016-7782 - CVSS 9.8 (critical), 2017-03-07: SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands…
• CVE-2016-7788 - CVSS 9.8 (critical), 2017-03-07: SQL injection vulnerability in framework/modules/users/models/user.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL…
• CVE-2016-9020 - CVSS 9.8 (critical), 2017-03-07: SQL injection vulnerability in framework/modules/help/controllers/helpController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute…
• CVE-2016-7781 - CVSS 9.8 (critical), 2017-03-07: SQL injection vulnerability in framework/modules/blog/controllers/blogController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute…