Vulnerabilities > Exponentcms > Exponent CMS > 2.6.0

DATE CVE VULNERABILITY TITLE RISK
2023-02-17 CVE-2021-32441 SQL Injection vulnerability in Exponentcms Exponent CMS 2.6.0
SQL Injection vulnerability in Exponent-CMS v.2.6.0 fixed in 2.7.0 allows attackers to gain access to sensitive information via the selectValue function in the expConfig class.
network
low complexity
exponentcms CWE-89
7.5
7.5
2022-02-09 CVE-2022-23047 Cross-site Scripting vulnerability in Exponentcms Exponent CMS 2.6.0
Exponent CMS 2.6.0patch2 allows an authenticated admin user to inject persistent JavaScript code inside the "Site/Organization Name","Site Title" and "Site Header" parameters while updating the site settings on "/exponentcms/administration/configure_site" 		3.5
3.5
2022-02-09 CVE-2022-23048 Unrestricted Upload of File with Dangerous Type vulnerability in Exponentcms Exponent CMS 2.6.0
Exponent CMS 2.6.0patch2 allows an authenticated admin user to upload a malicious extension in the format of a ZIP file with a PHP file inside it.
network
low complexity
exponentcms CWE-434
6.5
6.5
2022-02-09 CVE-2022-23049 Cross-site Scripting vulnerability in Exponentcms Exponent CMS 2.6.0
Exponent CMS 2.6.0patch2 allows an authenticated user to inject persistent JavaScript code on the "User-Agent" header when logging in. 		3.5
3.5