Vulnerability Database

296,336

Total vulnerabilities in the database

CVE-2013-3294

Multiple SQL injection vulnerabilities in Exponent CMS before 2.2.0 release candidate 1 allow remote attackers to execute arbitrary SQL commands via the (1) src or (2) username parameter to index.php.

Published: Feb 11, 2014
Updated: Apr 13, 2023
CVE: CVE-2013-3294
Severity: High
Exploit:

CVSS v2:

Severity: High
Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

CWE-89

OWASP TOP 10:

A1 - Injection

Affected Software
References

Software	From	Fixed in
exponentcms / exponent_cms	2.0.8	2.0.8.x
exponentcms / exponent_cms	2.0.0	2.0.0.x
exponentcms / exponent_cms	2.1.3	2.1.3.x
exponentcms / exponent_cms	2.0.6	2.0.6.x
exponentcms / exponent_cms	0.98.0	0.98.0.x
exponentcms / exponent_cms	2.1.1	2.1.1.x
exponentcms / exponent_cms	2.0.3	2.0.3.x
exponentcms / exponent_cms	2.0.5	2.0.5.x
exponentcms / exponent_cms	-	2.2.0.x
exponentcms / exponent_cms	2.0.9	2.0.9.x
exponentcms / exponent_cms	2.1.0	2.1.0.x
exponentcms / exponent_cms	2.1.2	2.1.2.x
exponentcms / exponent_cms	2.0.4	2.0.4.x
exponentcms / exponent_cms	2.1.4	2.1.4.x
exponentcms / exponent_cms	0.99.0-beta1	0.99.0-beta1.x
exponentcms / exponent_cms	2.0.7	2.0.7.x
exponentcms / exponent_cms	2.0.1	2.0.1.x
exponentcms / exponent_cms	2.0.2	2.0.2.x
exponentcms / exponent_cms	0.97.0	0.97.0.x