CVE-2016-9134

HIGH

Exponent CMS 2.3.9 - SQL Injection in expPaginator.php Order Parameter

Title source: llm

Exponent CMS 2.3.9 suffers from a SQL injection vulnerability in "/expPaginator.php" affecting the order parameter. Impact is Information Disclosure.

Core 3

Core References

Issue Tracking, Patch, Third Party Advisory x_refsource_confirm

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

Issue Tracking, Patch, Third Party Advisory x_refsource_confirm

CVSS v3 7.5

EPSS 0.0204

EPSS Percentile 78.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-200 CWE-89

Status published

Products (1)

exponentcms/exponent_cms 2.3.9

Published Nov 03, 2016

Tracked Since Feb 18, 2026