Exponent Cms
Approved changes feed: RSS · Atom
cpe:2.3:a:exponentcms:exponent_cms:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Exponentcms (c93592b0-b2a8-5154-96c1-44a265d7c303) |
|---|---|
| Product | Exponent Cms (864ae04b-7514-5db8-8b8b-80250d02e6c1) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/exponentcms/exponent-cms |
purl2cpe | 2026-06-01 10:16:48.668601 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-47931 |
vulnerable | 2026-06-08 05:38:07.925442 |
Exponent CMS 2.6 Multiple Vulnerabilities Stored XSS Authentication
MEDIUM (6.4)
Exponent CMS 2.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the Title and Text Block parameters in the text editing endpoint. Attackers can inject iframe payloads with embedded SVG onload events to execute arbitrary JavaScript. The application also exposes database credentials in responses and lacks brute-force protection on authentication endpoints.
Published: 2026-05-10T12:43:51.934Z
Updated: 2026-05-26T11:51:42.814Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-32441 |
vulnerable | 2026-06-08 05:31:54.788020 |
Details available
SQL Injection vulnerability in Exponent-CMS v.2.6.0 fixed in 2.7.0 allows attackers to gain access to sensitive information via the selectValue function in the expConfig class.
Published: 2023-02-17T00:00:00.000Z
Updated: 2025-03-19T15:11:04.611Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-7991 |
vulnerable | 2026-06-08 05:10:06.820000 |
Details available
Exponent CMS 2.4.1 and earlier has SQL injection via a base64 serialized API key (apikey parameter) in the api function of framework/modules/eaas/controllers/eaasController.php.
Published: 2017-04-22T01:00:00.000Z
Updated: 2024-08-05T16:19:29.486Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-18213 |
vulnerable | 2026-06-08 05:09:10.589968 |
Details available
In Exponent CMS before 2.4.1 Patch #6, certain admin users can elevate their privileges.
Published: 2018-03-04T02:00:00.000Z
Updated: 2024-09-16T20:43:35.734Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-9288 |
vulnerable | 2026-06-08 05:08:23.210740 |
Details available
In framework/modules/navigation/controllers/navigationController.php in Exponent CMS v2.4.0 or older, the parameter "target" of function "DragnDropReRank" is directly used without any filtration which caused SQL injection. The payload can be used like this: /navigation/DragnDropReRank/target/1.
Published: 2016-11-11T23:00:00.000Z
Updated: 2024-08-06T02:42:11.318Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-9272 |
vulnerable | 2026-06-08 05:08:23.196677 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-9087 |
vulnerable | 2026-06-08 05:08:22.552555 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-9026 |
vulnerable | 2026-06-08 05:08:22.434273 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-9025 |
vulnerable | 2026-06-08 05:08:22.433811 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-9023 |
vulnerable | 2026-06-08 05:08:22.433422 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-9022 |
vulnerable | 2026-06-08 05:08:22.433010 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-9021 |
vulnerable | 2026-06-08 05:08:22.432574 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-9020 |
vulnerable | 2026-06-08 05:08:22.432257 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-9019 |
vulnerable | 2026-06-08 05:08:22.431816 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-7789 |
vulnerable | 2026-06-08 05:08:13.193234 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-7788 |
vulnerable | 2026-06-08 05:08:13.192876 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-7784 |
vulnerable | 2026-06-08 05:08:13.185368 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-7783 |
vulnerable | 2026-06-08 05:08:13.185040 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-7782 |
vulnerable | 2026-06-08 05:08:13.184733 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-7781 |
vulnerable | 2026-06-08 05:08:13.184440 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-7780 |
vulnerable | 2026-06-08 05:08:13.184133 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-7453 |
vulnerable | 2026-06-08 05:08:12.663144 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-7452 |
vulnerable | 2026-06-08 05:08:12.662845 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-7443 |
vulnerable | 2026-06-08 05:08:12.652395 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-7400 |
vulnerable | 2026-06-08 05:08:12.290041 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-7095 |
vulnerable | 2026-06-08 05:08:11.762599 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-8684 |
vulnerable | 2026-06-08 05:07:04.718328 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2015-8667 |
vulnerable | 2026-06-08 05:07:04.651766 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-8690 |
vulnerable | 2026-06-08 05:06:09.872059 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2013-3295 |
vulnerable | 2026-06-08 05:04:30.813967 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2013-3294 |
vulnerable | 2026-06-08 05:04:30.802924 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.