Exponentcms Exponent Cms
59 CVEs affecting Exponentcms Exponent Cms. Latest disclosed: 2023-02-17. Critical: 33, High: 12.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-9026 | Critical | 9.8 | 2020-12-31 | Exponent CMS before 2.6.0 has improper input validation in fileController.php. |
CVE-2016-9025 | Critical | 9.8 | 2020-12-31 | Exponent CMS before 2.6.0 has improper input validation in purchaseOrderController.php. |
CVE-2016-9023 | Critical | 9.8 | 2020-12-31 | Exponent CMS before 2.6.0 has improper input validation in cron/find_help.php. |
CVE-2016-9022 | Critical | 9.8 | 2020-12-31 | Exponent CMS before 2.6.0 has improper input validation in usersController.php. |
CVE-2016-9021 | Critical | 9.8 | 2020-12-31 | Exponent CMS before 2.6.0 has improper input validation in storeController.php. |
CVE-2016-8900 | Critical | 9.8 | 2019-05-24 | Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expTagController.php related to change_tags. |
CVE-2016-8898 | Critical | 9.8 | 2019-05-24 | Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/ecommerce/controllers/cartController.php. |
CVE-2016-8899 | Critical | 9.8 | 2019-05-23 | Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expCatController.php related to change_cats. |
CVE-2016-8897 | Critical | 9.8 | 2019-05-23 | Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/help/controllers/helpController.php. |
CVE-2016-7443 | Critical | 9.8 | 2018-03-07 | Exponent CMS 2.3.0 through 2.3.9 allows remote attackers to have unspecified impact via vectors related to "uploading files to wrong location." |
CVE-2017-7991 | Critical | 9.8 | 2017-04-22 | Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key (apikey parameter) in the api function of framework/modules/eaas/controllers/e… |
CVE-2016-9087 | Critical | 9.8 | 2017-03-07 | SQL injection vulnerability in framework/modules/filedownloads/controllers/filedownloadController.php in Exponent CMS 2.3.9 and earlier allows remote attackers… |
CVE-2016-9020 | Critical | 9.8 | 2017-03-07 | SQL injection vulnerability in framework/modules/help/controllers/helpController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbit… |
CVE-2016-9019 | Critical | 9.8 | 2017-03-07 | SQL injection vulnerability in the activate_address function in framework/modules/addressbook/controllers/addressController.php in Exponent CMS 2.3.9 and earli… |
CVE-2016-7789 | Critical | 9.8 | 2017-03-07 | SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands… |
CVE-2016-7788 | Critical | 9.8 | 2017-03-07 | SQL injection vulnerability in framework/modules/users/models/user.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL comma… |
CVE-2016-7784 | Critical | 9.8 | 2017-03-07 | SQL injection vulnerability in the getSection function in framework/core/subsystems/expRouter.php in Exponent CMS 2.3.9 and earlier allows remote attackers to… |
CVE-2016-7783 | Critical | 9.8 | 2017-03-07 | SQL injection vulnerability in framework/core/models/expRecord.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands… |
CVE-2016-7782 | Critical | 9.8 | 2017-03-07 | SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands… |
CVE-2016-7781 | Critical | 9.8 | 2017-03-07 | SQL injection vulnerability in framework/modules/blog/controllers/blogController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbit… |