CVE-2026-108900
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and did not respond in any way.
Risk Assessment
The risk is remote SQL injection, potentially leading to unauthorized database access, data theft, or system integrity compromise.
Recommendation
Upgrade Exponent CMS to the latest version if available and deploy a web application firewall (WAF) to block SQL injection attacks.
Other vulnerabilities in Exponent CMS
See all- CVE-2016-9283High
Exponent CMS version 2.4.0 has an SQL Injection vulnerability in framework/core/subsystems/expRouter.php. This allows remote attackers to read database information via a specific URL.
- CVE-2016-9282High
Exponent CMS version 2.4.0 has an SQL Injection vulnerability in searchController.php, allowing remote attackers to read database information via the search_string parameter.
- CVE-2016-9242High
Exponent CMS 2.4.0 has multiple SQL injection vulnerabilities in the update method in expRatingController.php. This allows remote authenticated users to execute arbitrary SQL commands via the content_type or subtype parameters.
- CVE-2016-9184High
In Exponent CMS version 2.4.0, in the file /framework/modules/core/controllers/expHTMLEditorController.php, untrusted input is used to construct a table name, leading to SQL Injection vulnerability.
- CVE-2016-9183High
In Exponent CMS 2.4.0 in the file /framework/modules/ecommerce/controllers/orderController.php, untrusted input is passed into the selectObjectsBySql method. This method uses the injectProof method to prevent SQL injection, but this filter can be easily bypassed, leading to information disclosure.
- CVE-2016-9182High
Exponent CMS 2.4 uses PHP reflection to call methods of a controller class, leading to issues with user permission verification. Due to case insensitivity in method names, an attacker can bypass permission checks by using appropriately capitalized method names.
- CVE-2016-9135High
Exponent CMS version 2.3.9 suffers from a SQL injection vulnerability in '/framework/modules/help/controllers/helpController.php' affecting the version parameter. The impact is Information Disclosure.
- CVE-2016-9134High
Exponent CMS version 2.3.9 suffers from a SQL injection vulnerability in '/expPaginator.php' affecting the 'order' parameter.
- CVE-2013-3295High
CVE-2013-3295 in Exponent CMS before version 2.2.0 RC1 has a directory traversal vulnerability. It allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the page parameter.
- CVE-2017-7991Critical
Exponent CMS versions 2.4.1 and earlier have an SQL injection vulnerability via a base64 serialized API key (apikey parameter) in the api function of framework/modules/eaas/controllers/eaasController.php.
Original NVD description (English source)
A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS