CVE-2015-8684: Exponentcms Exponent CMS

Medium severity, CVSS 6.1. EPSS: 1.2% chance of exploitation in the next 30 days.

Exponent CMS before 2.3.7 does not properly restrict the types of files that can be uploaded, which allows remote attackers to conduct cross-site scripting (XSS) attacks and possibly have other unspecified impact as demonstrated by uploading a file with an .html extension, then accessing it via the elFinder functionality.

Affected products

• Exponentcms Exponent CMS: up to and including 2.3.5

Published 2017-01-18. Last modified 2026-06-17.