Aggregates CVE and security vulnerability intelligence across all Exponent CMS-related products, including CVSS, EPSS, publication dates, and vulnerability intelligence data.
Historical issues mainly involve vendor risk cross-site scripting, vendor risk path handling, and vendor risk input validation and related problems; some flaws may lead to vendor impact session compromise.
| CVE | Summary | Source | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|---|
| CVE-2016-9288 | In framework/modules/navigation/controllers/navigationController.php in Exponent CMS v2.4.0 or older, the parameter "target" of function "DragnDropReRank" is directly used without any filtration which caused SQL injection. The payload can be used like this: /navigation/DragnDropReRank/target/1. | [email protected] | 9.8 | 1.49% | 2016-11-11 | 2026-06-16 |
| CVE-2016-9286 | framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0patch1 does not properly restrict access to user records, which allows remote attackers to read address information, as demonstrated by an address/show/id/1 URI. | [email protected] | 5.3 | 1.48% | 2016-11-11 | 2026-06-16 |
| CVE-2016-9285 | framework/modules/addressbook/controllers/addressController.php in Exponent CMS v2.4.0 allows remote attackers to read user information via a modified id number, as demonstrated by address/edit/id/1, related to an "addresses, countries, and regions" issue. | [email protected] | 5.3 | 1.48% | 2016-11-11 | 2026-06-16 |
| CVE-2016-9284 | getUsersByJSON in framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0 allows remote attackers to read user information via users/getUsersByJSON/sort/ and a trailing string. | [email protected] | 5.3 | 1.48% | 2016-11-11 | 2026-06-16 |
| CVE-2016-9283 | SQL Injection in framework/core/subsystems/expRouter.php in Exponent CMS v2.4.0 allows remote attackers to read database information via address/addContentToSearch/id/ and a trailing string, related to a "sef URL" issue. | [email protected] | 7.5 | 1.70% | 2016-11-11 | 2026-06-16 |
| CVE-2016-9282 | SQL Injection in framework/modules/search/controllers/searchController.php in Exponent CMS v2.4.0 allows remote attackers to read database information via action=search&module=search with the search_string parameter. | [email protected] | 7.5 | 1.70% | 2016-11-11 | 2026-06-16 |
| CVE-2016-9272 | A Blind SQL Injection Vulnerability in Exponent CMS through 2.4.0, with the rerank array parameter, can lead to site database information disclosure and denial of service. | [email protected] | 9.1 | 2.23% | 2016-11-11 | 2026-06-16 |
| CVE-2016-9242 | Multiple SQL injection vulnerabilities in the update method in framework/modules/core/controllers/expRatingController.php in Exponent CMS 2.4.0 allow remote authenticated users to execute arbitrary SQL commands via the (1) content_type or (2) subtype parameter. | [email protected] | 8.8 | 1.37% | 2016-11-07 | 2026-06-16 |
| CVE-2016-9184 | In /framework/modules/core/controllers/expHTMLEditorController.php of Exponent CMS 2.4.0, untrusted input is used to construct a table name, and in the selectObject method in mysqli class, table names are wrapped with a character that common filters do not filter, allowing for SQL Injection. Impact is Information Disclosure. | [email protected] | 7.5 | 1.76% | 2016-11-04 | 2026-06-16 |
| CVE-2016-9183 | In /framework/modules/ecommerce/controllers/orderController.php of Exponent CMS 2.4.0, untrusted input is passed into selectObjectsBySql. The method selectObjectsBySql of class mysqli_database uses the injectProof method to prevent SQL injection, but this filter can be bypassed easily: it only sanitizes user input if there are odd numbers of ' or " characters. Impact is Information Disclosure. | [email protected] | 7.5 | 1.83% | 2016-11-04 | 2026-06-16 |
| CVE-2016-9182 | Exponent CMS 2.4 uses PHP reflection to call a method of a controller class, and then uses the method name to check user permission. But, the method name in PHP reflection is case insensitive, and Exponent CMS permits undefined actions to execute by default, so an attacker can use a capitalized method name to bypass the permission check, e.g., controller=expHTMLEditor&action=preview&editor=ckeditor and controller=expHTMLEditor&action=Preview&editor=ckeditor. An anonymous user will be rejected fo | [email protected] | 7.5 | 1.41% | 2016-11-04 | 2026-06-16 |
| CVE-2016-9135 | Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/framework/modules/help/controllers/helpController.php" affecting the version parameter. Impact is Information Disclosure. | [email protected] | 7.5 | 1.76% | 2016-11-03 | 2026-06-16 |
| CVE-2016-9134 | Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/expPaginator.php" affecting the order parameter. Impact is Information Disclosure. | [email protected] | 7.5 | 2.04% | 2016-11-03 | 2026-06-16 |
| CVE-2016-7453 | The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 could be used to perform an fid SQL Injection. | [email protected] | 9.8 | 1.49% | 2016-11-03 | 2026-06-16 |
| CVE-2016-7452 | The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 could be used to upload a malicious file to any folder on the site via a cpi directory traversal. | [email protected] | 7.5 | 1.69% | 2016-11-03 | 2026-06-16 |
| CVE-2016-7095 | Exponent CMS before 2.3.9 is vulnerable to an attacker uploading a malicious script file using redirection to place the script in an unprotected folder, one allowing script execution. | [email protected] | 9.8 | 2.30% | 2016-11-03 | 2026-06-16 |
| CVE-2014-8690 | Multiple cross-site scripting (XSS) vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, and 2.3.x before 2.3.1 patch 4 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO, the (2) src parameter in a none action to index.php, or the (3) "First Name" or (4) "Last Name" field to users/edituser. | [email protected] | 4.3 | 3.95% | 2015-02-19 | 2026-06-16 |
| CVE-2013-3295 | Directory traversal vulnerability in install/popup.php in Exponent CMS before 2.2.0 RC1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter. | [email protected] | 7.5 | 1.83% | 2014-12-29 | 2026-06-16 |
| CVE-2014-6635 | Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.0 allows remote attackers to inject arbitrary web script or HTML via the src parameter in the search action to index.php. | [email protected] | 4.3 | 1.42% | 2014-10-26 | 2026-06-16 |
| CVE-2013-3294 | Multiple SQL injection vulnerabilities in Exponent CMS before 2.2.0 release candidate 1 allow remote attackers to execute arbitrary SQL commands via the (1) src or (2) username parameter to index.php. | [email protected] | 7.5 | 2.45% | 2014-02-11 | 2026-06-16 |