Critical severity9.8NVD Advisory· Published Nov 29, 2016· Updated May 6, 2026
CVE-2016-9481
CVE-2016-9481
Description
In framework/modules/core/controllers/expCommentController.php of Exponent CMS 2.4.0, content_id input is passed into showComments. The method showComments is defined in the expCommentControllercontroller with the parameter '$this->params['content_id']' used directly in SQL. Impact is a SQL injection.
Affected products
1- cpe:2.3:a:exponentcms:exponent_cms:2.4.0:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
3- www.pang0lin.comnvdExploitTechnical Description
- www.securityfocus.com/bid/94590nvd
- www.securitytracker.com/id/1037368nvd
News mentions
0No linked articles in our index yet.