Exponent CMS 2.4.0
Approved changes feed: RSS · Atom
cpe:2.3:a:exponentcms:exponent_cms:2.4.0:*:*:*:*:*:*:*
part: a version: 2.4.0 update: *
| Vendor | Exponentcms (c93592b0-b2a8-5154-96c1-44a265d7c303) |
|---|---|
| Product | Exponent Cms (864ae04b-7514-5db8-8b8b-80250d02e6c1) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/exponentcms/exponent-cms |
purl2cpe | 2026-06-01 10:16:48.677553 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2016-9481 |
vulnerable | 2026-06-08 05:08:23.980760 |
Details available
In framework/modules/core/controllers/expCommentController.php of Exponent CMS 2.4.0, content_id input is passed into showComments. The method showComments is defined in the expCommentControllercontroller with the parameter '$this->params['content_id']' used directly in SQL. Impact is a SQL injection.
Published: 2016-11-29T23:00:00.000Z
Updated: 2024-08-06T02:50:38.364Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-9286 |
vulnerable | 2026-06-08 05:08:23.208040 |
Details available
framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0patch1 does not properly restrict access to user records, which allows remote attackers to read address information, as demonstrated by an address/show/id/1 URI.
Published: 2016-11-11T22:00:00.000Z
Updated: 2024-08-06T02:42:11.281Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-9285 |
vulnerable | 2026-06-08 05:08:23.207727 |
Details available
framework/modules/addressbook/controllers/addressController.php in Exponent CMS v2.4.0 allows remote attackers to read user information via a modified id number, as demonstrated by address/edit/id/1, related to an "addresses, countries, and regions" issue.
Published: 2016-11-11T22:00:00.000Z
Updated: 2024-08-06T02:42:11.273Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-9284 |
vulnerable | 2026-06-08 05:08:23.207286 |
Details available
getUsersByJSON in framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0 allows remote attackers to read user information via users/getUsersByJSON/sort/ and a trailing string.
Published: 2016-11-11T22:00:00.000Z
Updated: 2024-08-06T02:42:11.312Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-9283 |
vulnerable | 2026-06-08 05:08:23.206971 |
Details available
SQL Injection in framework/core/subsystems/expRouter.php in Exponent CMS v2.4.0 allows remote attackers to read database information via address/addContentToSearch/id/ and a trailing string, related to a "sef URL" issue.
Published: 2016-11-11T22:00:00.000Z
Updated: 2024-08-06T02:42:11.221Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-9282 |
vulnerable | 2026-06-08 05:08:23.206654 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-9242 |
vulnerable | 2026-06-08 05:08:23.029931 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-9184 |
vulnerable | 2026-06-08 05:08:22.867833 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-9183 |
vulnerable | 2026-06-08 05:08:22.867495 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-9182 |
vulnerable | 2026-06-08 05:08:22.867087 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.