Exponentcms
Exponentcms Exponent CMS: vulnerabilidades y CVE
Exponentcms Exponent CMS tiene 59 vulnerabilidades publicadas, 0 de ellas en los últimos 12 meses. 33 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE59
Últimos 12 meses0
Críticas33
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2021-32441 | Alta (7.5) | 0.60% | — | 17 feb 2023 | SQL Injection vulnerability in Exponent-CMS v.2.6.0 fixed in 2.7.0 allows attackers to gain access to sensitive information via the selectValue function in the expConfig class. |
| CVE-2022-23049 | Media (5.4) | 3.0% | — | 9 feb 2022 | Exponent CMS 2.6.0patch2 allows an authenticated user to inject persistent JavaScript code on the "User-Agent" header when logging in. When an administrator user visits the "User Sessions" tab, the JavaScript will be… |
| CVE-2022-23048 | Alta (7.2) | 2.1% | — | 9 feb 2022 | Exponent CMS 2.6.0patch2 allows an authenticated admin user to upload a malicious extension in the format of a ZIP file with a PHP file inside it. After upload it, the PHP file will be placed at… |
| CVE-2022-23047 | Media (4.8) | 2.9% | — | 9 feb 2022 | Exponent CMS 2.6.0patch2 allows an authenticated admin user to inject persistent JavaScript code inside the "Site/Organization Name","Site Title" and "Site Header" parameters while updating the site settings on… |
| CVE-2016-9026 | Crítica (9.8) | 1.3% | — | 31 dic 2020 | Exponent CMS before 2.6.0 has improper input validation in fileController.php. |
| CVE-2016-9025 | Crítica (9.8) | 1.3% | — | 31 dic 2020 | Exponent CMS before 2.6.0 has improper input validation in purchaseOrderController.php. |
| CVE-2016-9023 | Crítica (9.8) | 1.3% | — | 31 dic 2020 | Exponent CMS before 2.6.0 has improper input validation in cron/find_help.php. |
| CVE-2016-9022 | Crítica (9.8) | 1.3% | — | 31 dic 2020 | Exponent CMS before 2.6.0 has improper input validation in usersController.php. |
| CVE-2016-9021 | Crítica (9.8) | 1.3% | — | 31 dic 2020 | Exponent CMS before 2.6.0 has improper input validation in storeController.php. |
| CVE-2016-8900 | Crítica (9.8) | 2.1% | — | 24 may 2019 | Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expTagController.php related to change_tags. |
| CVE-2016-8898 | Crítica (9.8) | 1.8% | — | 24 may 2019 | Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/ecommerce/controllers/cartController.php. |
| CVE-2016-8899 | Crítica (9.8) | 2.1% | — | 23 may 2019 | Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expCatController.php related to change_cats. |
| CVE-2016-8897 | Crítica (9.8) | 1.8% | — | 23 may 2019 | Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/help/controllers/helpController.php. |
| CVE-2016-7443 | Crítica (9.8) | 2.2% | — | 7 mar 2018 | Exponent CMS 2.3.0 through 2.3.9 allows remote attackers to have unspecified impact via vectors related to "uploading files to wrong location." |
| CVE-2017-18213 | Alta (7.2) | 1.4% | — | 4 mar 2018 | In Exponent CMS before 2.4.1 Patch #6, certain admin users can elevate their privileges. |
| CVE-2015-1177 | Media (6.1) | 1.5% | — | 28 ago 2017 | Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.2. |
| CVE-2017-8085 | Media (6.1) | 1.1% | — | 24 abr 2017 | In Exponent CMS before 2.4.1 Patch #5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php. |
| CVE-2017-7991 | Crítica (9.8) | 2.1% | — | 22 abr 2017 | Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key (apikey parameter) in the api function of framework/modules/eaas/controllers/eaasController.php. |
| CVE-2016-9087 | Crítica (9.8) | 2.2% | — | 7 mar 2017 | SQL injection vulnerability in framework/modules/filedownloads/controllers/filedownloadController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the fileid parameter. |
| CVE-2016-9020 | Crítica (9.8) | 3.1% | — | 7 mar 2017 | SQL injection vulnerability in framework/modules/help/controllers/helpController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the version parameter. |
| CVE-2016-9019 | Crítica (9.8) | 3.3% | — | 7 mar 2017 | SQL injection vulnerability in the activate_address function in framework/modules/addressbook/controllers/addressController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands… |
| CVE-2016-7789 | Crítica (9.8) | 2.5% | — | 7 mar 2017 | SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the apikey parameter. |
| CVE-2016-7788 | Crítica (9.8) | 2.6% | — | 7 mar 2017 | SQL injection vulnerability in framework/modules/users/models/user.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter. |
| CVE-2016-7784 | Crítica (9.8) | 2.6% | — | 7 mar 2017 | SQL injection vulnerability in the getSection function in framework/core/subsystems/expRouter.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the section parameter. |
| CVE-2016-7783 | Crítica (9.8) | 2.6% | — | 7 mar 2017 | SQL injection vulnerability in framework/core/models/expRecord.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the title parameter. |
| CVE-2016-7782 | Crítica (9.8) | 2.6% | — | 7 mar 2017 | SQL injection vulnerability in framework/core/models/expConfig.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the src parameter. |
| CVE-2016-7781 | Crítica (9.8) | 2.6% | — | 7 mar 2017 | SQL injection vulnerability in framework/modules/blog/controllers/blogController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the author parameter. |
| CVE-2016-7780 | Crítica (9.8) | 2.6% | — | 7 mar 2017 | SQL injection vulnerability in cron/find_help.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the version parameter. |
| CVE-2016-7565 | Crítica (9.8) | 2.3% | — | 13 feb 2017 | install/index.php in Exponent CMS 2.3.9 allows remote attackers to execute arbitrary commands via shell metacharacters in the sc array parameter. |
| CVE-2016-7400 | Crítica (9.8) | 4.7% | — | 7 feb 2017 | Multiple SQL injection vulnerabilities in Exponent CMS before 2.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an activate_address address controller action, (2) title parameter… |