CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 09/02/2022 |
| CVE-2022-23047 | 中危4.8 | Exponent CMS 2.6.0patch2 allows an authenticated admin user to inject persistent JavaScript code inside the "Site/Organization Name","Site Title" and "Site Header" parameters while updating the site settings on "/exponentcms/administration/configure_site" | 09/02/2022 |
| CVE-2021-38751 | 中危4.3 | A HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponent_constants.php. A modified HTTP header can change links on the webpage to an arbitrary value, leading to a possible attack vector for MITM. | 16/08/2021 |
| CVE-2016-9026 | 严重9.8 | Exponent CMS before 2.6.0 has improper input validation in fileController.php. | 31/12/2020 |
| CVE-2016-9025 | 严重9.8 | Exponent CMS before 2.6.0 has improper input validation in purchaseOrderController.php. | 31/12/2020 |
| CVE-2016-9023 | 严重9.8 | Exponent CMS before 2.6.0 has improper input validation in cron/find_help.php. | 31/12/2020 |
| CVE-2016-9022 | 严重9.8 | Exponent CMS before 2.6.0 has improper input validation in usersController.php. | 31/12/2020 |
| CVE-2016-9021 | 严重9.8 | Exponent CMS before 2.6.0 has improper input validation in storeController.php. | 31/12/2020 |
| CVE-2016-8900 | 严重9.8 | Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expTagController.php related to change_tags. | 24/05/2019 |
| CVE-2016-8898 | 严重9.8 | Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/ecommerce/controllers/cartController.php. | 24/05/2019 |
| CVE-2016-8899 | 严重9.8 | Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expCatController.php related to change_cats. | 23/05/2019 |
| CVE-2016-8897 | 严重9.8 | Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/help/controllers/helpController.php. | 23/05/2019 |
| CVE-2016-7443 | 严重9.8 | Exponent CMS 2.3.0 through 2.3.9 allows remote attackers to have unspecified impact via vectors related to "uploading files to wrong location." | 07/03/2018 |
| CVE-2017-18213 | 高危7.2 | In Exponent CMS before 2.4.1 Patch #6, certain admin users can elevate their privileges. | 04/03/2018 |
| CVE-2015-1177 | 中危6.1 | Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.2. | 28/08/2017 |
| CVE-2017-8085 | 中危6.1 | In Exponent CMS before 2.4.1 Patch #5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php. | 24/04/2017 |
| CVE-2017-7991 | 严重9.8 | Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key (apikey parameter) in the api function of framework/modules/eaas/controllers/eaasController.php. | 22/04/2017 |
| CVE-2016-9087 | 严重9.8 | SQL injection vulnerability in framework/modules/filedownloads/controllers/filedownloadController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the fileid parameter. | 07/03/2017 |