Exponentcms » Exponent Cms : Security Vulnerabilities, CVEs, Published In 2014
Cross-site scripting (XSS) vulnerability in Exponent CMS 2.3.0 allows remote attackers to inject arbitrary web script or HTML via the src parameter in the search action to index.php.
Max CVSS
4.3
EPSS Score
0.14%
Published
2014-10-26
Updated
2017-09-08
Directory traversal vulnerability in install/popup.php in Exponent CMS before 2.2.0 RC1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.
Max CVSS
7.5
EPSS Score
1.84%
Published
2014-12-30
Updated
2014-12-30
Multiple SQL injection vulnerabilities in Exponent CMS before 2.2.0 release candidate 1 allow remote attackers to execute arbitrary SQL commands via the (1) src or (2) username parameter to index.php.
Max CVSS
7.5
EPSS Score
0.14%
Published
2014-02-11
Updated
2017-08-29
3 vulnerabilities found