TI-2026-71024 CVE-2026-108900 · GHSA-69p7-vpq6-728f
SQL injection in Exponent CMS XML-RPC userLogin function
Priority HIGH 70
A vulnerability has been found in Exponent CMS up to 3.0.2patch2.
Exponent
Records17All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
Exponent records in CISA KEVNo Exponent vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
17 records
TI-2006-01553 CVE-2006-1604 · GHSA-p457-mr62-5g69
Unspecified vulnerability in Exponent CMS before 0.96.5 RC 1 has unknown impact and…
Priority MEDIUM 46
Unspecified vulnerability in Exponent CMS before 0.96.5 RC 1 has unknown impact and remote attack vectors related to variables that are not "typecasted."
TI-2005-03558 CVE-2005-3764 · GHSA-6r8p-cw9m-43r8
The image gallery (imagegallery) component in Exponent CMS 0.96.3 and later versions does…
Priority MEDIUM 46
The image gallery (imagegallery) component in Exponent CMS 0.96.3 and later versions does not properly check the MIME type of uploaded files, with unknown impact from the preview icon, possibly involving injection of HTM…
TI-2006-04781 CVE-2006-4963 · GHSA-7m7w-8c5p-c54j
Directory traversal vulnerability in index.php in Exponent CMS 0.96.3 allows remote…
Priority LOW 38
Directory traversal vulnerability in index.php in Exponent CMS 0.96.3 allows remote attackers to read and execute arbitrary local files via a ..
TI-2006-01554 CVE-2006-1605 · GHSA-7m57-j2xj-6xj3
Unspecified vulnerability in the image module in Exponent CMS before 0.96.5 RC 1 allows…
Priority LOW 38
Unspecified vulnerability in the image module in Exponent CMS before 0.96.5 RC 1 allows remote attackers to execute arbitrary code via unknown vectors involving "parsed PHP."
TI-2005-03559 CVE-2005-3765 · GHSA-gp9r-8xcc-jcx5
Exponent CMS 0.96.3 and later versions performs a chmod on uploaded files to give them…
Priority LOW 38
Exponent CMS 0.96.3 and later versions performs a chmod on uploaded files to give them execute permissions, which allows remote attackers to execute arbitrary code.
TI-2006-01556 CVE-2006-1607 · GHSA-2pq8-vhfp-3f4x
Unspecified vulnerability in the banner module in Exponent CMS before 0.96.5 RC 1 allows…
Priority LOW 36
Unspecified vulnerability in the banner module in Exponent CMS before 0.96.5 RC 1 allows "php injection" via unknown attack vectors.
TI-2005-03556 CVE-2005-3762 · GHSA-jc86-5gcp-4hv4
SQL injection vulnerability in the navigation module (navigationmodule) in Exponent CMS…
Priority LOW 36
SQL injection vulnerability in the navigation module (navigationmodule) in Exponent CMS 0.96.3 and later versions allows remote attackers to execute arbitrary SQL commands via the parent parameter.
TI-2007-02170 CVE-2007-2252 · GHSA-q26c-r44c-gj49
Directory traversal vulnerability in iconspopup.php in Exponent CMS 0.96.6 Alpha and…
Priority LOW 28
Directory traversal vulnerability in iconspopup.php in Exponent CMS 0.96.6 Alpha and earlier allows remote attackers to obtain sensitive information via a ..
TI-2007-02171 CVE-2007-2253 · GHSA-m3vc-4q6p-fwgq
Exponent CMS 0.96.6 Alpha and earlier allows remote attackers to obtain path information…
Priority LOW 26
Exponent CMS 0.96.6 Alpha and earlier allows remote attackers to obtain path information via a direct request for (1) sdk/blanks/formcontrol.php and (2) sdk/blanks/file_modules.php.
TI-2005-03561 CVE-2005-3767 · GHSA-r426-fgvw-5w9p
Exponent CMS 0.96.3 and later versions does not properly restrict the types of uploaded…
Priority LOW 26
Exponent CMS 0.96.3 and later versions does not properly restrict the types of uploaded files, which allows remote attackers to upload and execute PHP files.
TI-2005-03557 CVE-2005-3763 · GHSA-pfmw-hj52-wcrc
Exponent CMS 0.96.3 and later versions includes the full installation path in the base…
Priority LOW 26
Exponent CMS 0.96.3 and later versions includes the full installation path in the base parameter to thumb.php, which allows remote attackers to obtain sensitive information.
TI-2005-00275 CVE-2005-0310 · GHSA-ffwp-x9qh-p236
Exponent 0.95 allows remote attackers to obtain sensitive information via a direct HTTP…
Priority LOW 26
Exponent 0.95 allows remote attackers to obtain sensitive information via a direct HTTP request to (1) search.info.php, (2) permissions.info.php, (3) security.info.php, (4) formcontrol.php, or (5) file_modules.php, which…
TI-2006-01555 CVE-2006-1606 · GHSA-p4qj-4hxr-r557
Unspecified vulnerability in the image module in Exponent CMS before 0.96.5 RC 1 allows…
Priority LOW 25
Unspecified vulnerability in the image module in Exponent CMS before 0.96.5 RC 1 allows "directory disclosure" with unknown attack vectors.
TI-2005-03560 CVE-2005-3766 · GHSA-v87m-2q74-9xw3
Exponent CMS 0.96.3 and later versions stores sensitive user pages under the web document…
Priority LOW 25
Exponent CMS 0.96.3 and later versions stores sensitive user pages under the web document root with insufficient access control even though certain permissions are specified, which allows attackers to access the pages by…
TI-2005-03555 CVE-2005-3761 · GHSA-f37w-3rf5-92hr
Cross-site scripting (XSS) vulnerability in Exponent CMS 0.96.3 and later versions allows…
Priority LOW 22
Cross-site scripting (XSS) vulnerability in Exponent CMS 0.96.3 and later versions allows remote attackers to inject arbitrary web script or HTML via (1) Javascript in forms produced by the form generator or (2) the para…
TI-2005-00274 CVE-2005-0309 · GHSA-rhvj-775v-w2fh
Multiple cross-site scripting (XSS) vulnerabilities in (1) index.php or (2) mod.php in…
Priority LOW 22
Multiple cross-site scripting (XSS) vulnerabilities in (1) index.php or (2) mod.php in Exponent 0.95 allow remote attackers to inject arbitrary web script or HTML via the module parameter.