CVE-2016-7400: Exponentcms Exponent CMS

Critical severity, CVSS 9.8. EPSS: 4.7% chance of exploitation in the next 30 days.

Multiple SQL injection vulnerabilities in Exponent CMS before 2.4.0 allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in an activate_address address controller action, (2) title parameter in a show blog controller action, or (3) content_id parameter in a showComments expComment controller action.

Affected products

• Exponentcms Exponent CMS: up to and including 2.3.9

Published 2017-02-07. Last modified 2026-06-17.