Medium severity5.3NVD Advisory· Published Nov 11, 2016· Updated May 6, 2026

CVE-2016-9285

Description

framework/modules/addressbook/controllers/addressController.php in Exponent CMS v2.4.0 allows remote attackers to read user information via a modified id number, as demonstrated by address/edit/id/1, related to an "addresses, countries, and regions" issue.

Affected products

Exponent/Exponent CMS
cpe:2.3:a:exponentcms:exponent_cms:2.4.0:*:*:*:*:*:*:*

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

github.com/exponentcms/exponent-cms/commit/9eeed1e82fb9e6d0d41e7dd10672df48045a9b59nvdIssue TrackingPatch
www.securityfocus.com/bid/94296nvdThird Party AdvisoryVDB Entry
www.securitytracker.com/id/1037281nvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000