Exponent CMS CVE-2026-108900

Exploitation requires the XML-RPC interface to be reachable and, per the public exploit documentation, the USE_XMLRPC feature/configuration flag to be enabled - this is the specific gating condition and is not guaranteed in default deployments. When that feature is active, the userLogin handler in xmlrpc.php fails to sanitize the username input, allowing SQL injection via a crafted XML-RPC request with no authentication or user interaction (PR:N/UI:N). The primary limiting factors are: (1) the optional/non-default USE_XMLRPC setting must be on, (2) the xmlrpc.php endpoint must be network-exposed, and (3) affected versions are Exponent CMS up to and including 3.0.2patch2. No patch or fixed version is confirmed, as the vendor reportedly did not respond.

This is a moderate-risk SQL injection (CWE-89) in Exponent CMS, best treated as a patch-when-practical issue rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, unauthenticated, low-complexity exploitation, which sounds severe, but the vendor-assigned impacts are all Low (VC:L/VI:L/VA:L) and the subsequent-system impacts are None, holding the score to 6.9 (Medium). The CVSS 4.0 string carries E:P (Proof-of-Concept), consistent with the publicly disclosed exploit, meaning exploit code exists but there is no evidence of automated weaponization. There is NO CISA KEV listing and NO EPSS score was provided in the input, so widespread or automated exploitation cannot be asserted - the signals point to opportunistic rather than mass exploitation. A key limiting factor not reflected in the raw vector: the public exploit title indicates the flaw is reachable only 'when USE_XMLRPC is enabled,' a non-default/optional feature, which materially narrows the exposed population despite the PR:N rating. Net: real but not critical priority - the unauthenticated network vector warrants attention, but low technical impact, no KEV/EPSS escalation, a niche product, and a configuration prerequisite all temper real-world urgency.

A remote, unauthenticated attacker sends a crafted XML-RPC request to xmlrpc.php targeting the userLogin function, injecting SQL through the username field to manipulate the backend database query. Public exploit documentation already exists (hosted on GitHub), lowering the barrier to reproduction, though exploitation requires the optional USE_XMLRPC feature to be enabled on the target. Given AV:N/AC:L, a single HTTP POST to the exposed endpoint is sufficient to attempt the injection.