Exponentcms Exponent Cms vulnerabilities

CVE-2014-8690 [MEDIUM] CWE-79 CVE-2014-8690: Multiple cross-site scripting (XSS) vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x befo Multiple cross-site scripting (XSS) vulnerabilities in Exponent CMS before 2.1.4 patch 6, 2.2.x before 2.2.3 patch 9, and 2.3.x before 2.3.1 patch 4 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO, the (2) src parameter in a none action to index.php, or the (3) "First Name" or (4) "Last Name" field to users/edituser.

CVE-2022-23048 [HIGH] CWE-434 CVE-2022-23048: Exponent CMS 2.6.0patch2 allows an authenticated admin user to upload a malicious extension in the f Exponent CMS 2.6.0patch2 allows an authenticated admin user to upload a malicious extension in the format of a ZIP file with a PHP file inside it. After upload it, the PHP file will be placed at "themes/simpletheme/{rce}.php" from where can be accessed in order to execute commands.

CVE-2021-32441 [HIGH] CWE-89 CVE-2021-32441: SQL Injection vulnerability in Exponent-CMS v.2.6.0 fixed in 2.7.0 allows attackers to gain access t SQL Injection vulnerability in Exponent-CMS v.2.6.0 fixed in 2.7.0 allows attackers to gain access to sensitive information via the selectValue function in the expConfig class.

CVE-2016-9183 [HIGH] CWE-200 CVE-2016-9183: In /framework/modules/ecommerce/controllers/orderController.php of Exponent CMS 2.4.0, untrusted inp In /framework/modules/ecommerce/controllers/orderController.php of Exponent CMS 2.4.0, untrusted input is passed into selectObjectsBySql. The method selectObjectsBySql of class mysqli_database uses the injectProof method to prevent SQL injection, but this filter can be bypassed easily: it only sanitizes user input if there are odd numbers of ' or " char

CVE-2016-9184 [HIGH] CWE-89 CVE-2016-9184: In /framework/modules/core/controllers/expHTMLEditorController.php of Exponent CMS 2.4.0, untrusted In /framework/modules/core/controllers/expHTMLEditorController.php of Exponent CMS 2.4.0, untrusted input is used to construct a table name, and in the selectObject method in mysqli class, table names are wrapped with a character that common filters do not filter, allowing for SQL Injection. Impact is Information Disclosure.

CVE-2016-7452 [HIGH] CWE-434 CVE-2016-7452: The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 could be used to upload a malicious The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 could be used to upload a malicious file to any folder on the site via a cpi directory traversal.

CVE-2016-9182 [HIGH] CWE-284 CVE-2016-9182: Exponent CMS 2.4 uses PHP reflection to call a method of a controller class, and then uses the metho Exponent CMS 2.4 uses PHP reflection to call a method of a controller class, and then uses the method name to check user permission. But, the method name in PHP reflection is case insensitive, and Exponent CMS permits undefined actions to execute by default, so an attacker can use a capitalized method name to bypass the permission check, e.g., controlle

CVE-2010-5002 [MEDIUM] CWE-79 CVE-2010-5002: Cross-site scripting (XSS) vulnerability in modules/slideshowmodule/slideshow.js.php in Exponent CMS Cross-site scripting (XSS) vulnerability in modules/slideshowmodule/slideshow.js.php in Exponent CMS 0.97.0 allows remote attackers to inject arbitrary web script or HTML via the u parameter.

CVE-2017-18213 [HIGH] CVE-2017-18213: In Exponent CMS before 2.4.1 Patch #6, certain admin users can elevate their privileges. In Exponent CMS before 2.4.1 Patch #6, certain admin users can elevate their privileges.

CVE-2021-47931 [MEDIUM] CWE-79 CVE-2021-47931: Exponent CMS 2.6 contains a stored cross-site scripting vulnerability that allows authenticated atta Exponent CMS 2.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the Title and Text Block parameters in the text editing endpoint. Attackers can inject iframe payloads with embedded SVG onload events to execute arbitrary JavaScript. The application also exposes database cred

CVE-2022-23049 [MEDIUM] CWE-79 CVE-2022-23049: Exponent CMS 2.6.0patch2 allows an authenticated user to inject persistent JavaScript code on the "U Exponent CMS 2.6.0patch2 allows an authenticated user to inject persistent JavaScript code on the "User-Agent" header when logging in. When an administrator user visits the "User Sessions" tab, the JavaScript will be triggered allowing an attacker to compromise the administrator session.

CVE-2016-9286 [MEDIUM] CWE-200 CVE-2016-9286: framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0patch1 does not proper framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0patch1 does not properly restrict access to user records, which allows remote attackers to read address information, as demonstrated by an address/show/id/1 URI.

CVE-2016-9284 [MEDIUM] CWE-200 CVE-2016-9284: getUsersByJSON in framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0 all getUsersByJSON in framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0 allows remote attackers to read user information via users/getUsersByJSON/sort/ and a trailing string.

CVE-2016-9285 [MEDIUM] CWE-200 CVE-2016-9285: framework/modules/addressbook/controllers/addressController.php in Exponent CMS v2.4.0 allows remote framework/modules/addressbook/controllers/addressController.php in Exponent CMS v2.4.0 allows remote attackers to read user information via a modified id number, as demonstrated by address/edit/id/1, related to an "addresses, countries, and regions" issue.

CVE-2015-8684 [MEDIUM] CWE-79 CVE-2015-8684: Exponent CMS before 2.3.7 does not properly restrict the types of files that can be uploaded, which Exponent CMS before 2.3.7 does not properly restrict the types of files that can be uploaded, which allows remote attackers to conduct cross-site scripting (XSS) attacks and possibly have other unspecified impact as demonstrated by uploading a file with an .html extension, then accessing it via the elFinder functionality.

CVE-2015-8667 [MEDIUM] CWE-79 CVE-2015-8667: Cross-site scripting (XSS) vulnerability in Reset Your Password module in Exponent CMS before 2.3.5 Cross-site scripting (XSS) vulnerability in Reset Your Password module in Exponent CMS before 2.3.5 allows remote attackers to inject arbitrary web script or HTML via the Username/Email.

CVE-2017-8085 [MEDIUM] CWE-79 CVE-2017-8085: In Exponent CMS before 2.4.1 Patch #5, XSS in elFinder is possible in framework/modules/file/connect In Exponent CMS before 2.4.1 Patch #5, XSS in elFinder is possible in framework/modules/file/connector/elfinder.php.

CVE-2015-1177 [MEDIUM] CWE-79 CVE-2015-1177: Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.2. Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.2.

CVE-2022-23047 [MEDIUM] CWE-79 CVE-2022-23047: Exponent CMS 2.6.0patch2 allows an authenticated admin user to inject persistent JavaScript code ins Exponent CMS 2.6.0patch2 allows an authenticated admin user to inject persistent JavaScript code inside the "Site/Organization Name","Site Title" and "Site Header" parameters while updating the site settings on "/exponentcms/administration/configure_site"

CVE-2014-6635 [MEDIUM] CWE-79 CVE-2014-6635: Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.0 allows remote attackers to inject arb Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.0 allows remote attackers to inject arbitrary web script or HTML via the src parameter in the search action to index.php.