Back to CVE Browser

CVE-2016-7095

CRITICAL

9.8

CVSS Severity Score

EPSS Score0.1790%

EPSS Percentile42.59th

PublishedNov 3, 2016

Last ModifiedMay 6, 2026

Vulnerability Description

Exponent CMS before 2.3.9 is vulnerable to an attacker uploading a malicious script file using redirection to place the script in an unprotected folder, one allowing script execution.

Affected Platforms (CPE)

📦

Exponentcms

Exponent Cms

<= 2.3.8

References & Advisories

🔗 http://www.exponentcms.org/news/security-vulnerability-all-exponent-versions-june-2016

🔗 http://www.securityfocus.com/bid/94121

🔗 https://github.com/exponentcms/exponent-cms/releases/tag/v2.4.0

🔗 http://www.exponentcms.org/news/security-vulnerability-all-exponent-versions-june-2016

🔗 http://www.securityfocus.com/bid/94121

🔗 https://github.com/exponentcms/exponent-cms/releases/tag/v2.4.0

Related Vulnerabilities

CVE-2006-160410.0

Unspecified vulnerability in Exponent CMS before 0.96.5 RC 1 has unknown impact and remote attack vectors related to variables tha...

CVE-2005-376410.0

The image gallery (imagegallery) component in Exponent CMS 0.96.3 and later versions does not properly check the MIME type of uplo...

CVE-2016-94819.8

In framework/modules/core/controllers/expCommentController.php of Exponent CMS 2.4.0, content_id input is passed into showComments...

CVE-2016-74539.8

The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 could be used to perform an fid SQL Injection.