Exponent
Monthly
SQL injection in Exponent CMS versions up to and including 3.0.2patch2 allows unauthenticated remote attackers to execute arbitrary SQL via the userLogin function in xmlrpc.php when the optional USE_XMLRPC configuration flag is enabled and the endpoint is network-reachable. The flaw stems from unsanitized username input (CWE-89), and publicly available exploit code exists, though exploitation is gated by the non-default XML-RPC setting, limiting real-world exposure. The vendor did not respond to disclosure, so no official fix is available; this is a moderate-risk issue (assessed CVSS 3.1: 6.9) best handled with compensating controls such as disabling USE_XMLRPC or restricting access to xmlrpc.php.
SQL injection in Exponent CMS versions up to and including 3.0.2patch2 allows unauthenticated remote attackers to execute arbitrary SQL via the userLogin function in xmlrpc.php when the optional USE_XMLRPC configuration flag is enabled and the endpoint is network-reachable. The flaw stems from unsanitized username input (CWE-89), and publicly available exploit code exists, though exploitation is gated by the non-default XML-RPC setting, limiting real-world exposure. The vendor did not respond to disclosure, so no official fix is available; this is a moderate-risk issue (assessed CVSS 3.1: 6.9) best handled with compensating controls such as disabling USE_XMLRPC or restricting access to xmlrpc.php.