Exponent CMS
70 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Exponent CMS, a product in the web cms plugins space. Use it to gauge the current risk picture and drill into individual advisories.
Exponent CMS CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 1 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 70 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical34
- High16
- Medium20
Latest CVEs
The 15 most recently published vulnerabilities affecting Exponent CMS.
- CVE-2021-47931Exponent CMS 2.6 Multiple Vulnerabilities Stored XSS Authentication6.4
- CVE-2021-32441SQL Injection vulnerability in Exponent-CMS v.2.6.0 fixed in 2.7.0 allows attackers to gain access to sensitive information via the selectValue function in the expConfig class.7.5
- CVE-2022-23049Exponent CMS 2.6.0patch2 allows an authenticated user to inject persistent JavaScript code on the "User-Agent" header when logging in. When an administrator user visits the "User Sessions" tab, the...5.4
- CVE-2022-23048Exponent CMS 2.6.0patch2 allows an authenticated admin user to upload a malicious extension in the format of a ZIP file with a PHP file inside it. After upload it, the PHP file will be placed at "t...7.2
- CVE-2022-23047Exponent CMS 2.6.0patch2 allows an authenticated admin user to inject persistent JavaScript code inside the "Site/Organization Name","Site Title" and "Site Header" parameters while updating the sit...4.8
- CVE-2016-9023Exponent CMS before 2.6.0 has improper input validation in cron/find_help.php.9.8
- CVE-2016-9026Exponent CMS before 2.6.0 has improper input validation in fileController.php.9.8
- CVE-2016-9025Exponent CMS before 2.6.0 has improper input validation in purchaseOrderController.php.9.8
- CVE-2016-9022Exponent CMS before 2.6.0 has improper input validation in usersController.php.9.8
- CVE-2016-9021Exponent CMS before 2.6.0 has improper input validation in storeController.php.9.8
- CVE-2016-8898Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/ecommerce/controllers/cartController.php.9.8
- CVE-2016-8900Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expTagController.php related to change_tags.9.8
- CVE-2016-8897Exponent CMS version 2.3.9 suffers from a sql injection vulnerability in framework/modules/help/controllers/helpController.php.9.8
- CVE-2016-8899Exponent CMS version 2.3.9 suffers from a Object Injection vulnerability in framework/modules/core/controllers/expCatController.php related to change_cats.9.8
- CVE-2016-7443Exponent CMS 2.3.0 through 2.3.9 allows remote attackers to have unspecified impact via vectors related to "uploading files to wrong location."9.8
Product grouping is registry-driven, with AI assist and human review. How it works