Information Disclosure

Every one of the 4 is a mark on the map. Named now: 1 to 4, most at risk first.

1. In /framework/modules/ecommerce/controllers/orderController.php of Exponent CMS 2.4.0, untrusted input is passed into selectObjectsBySql. The method selectObjectsBySql of class my…CVE-2016-9183Exponentcms · 1.8% likely

   CWE-200

2. framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0patch1 does not properly restrict access to user records, which allows remote attackers to read addre…CVE-2016-9286Exponentcms · 1.5% likely

   CWE-200

3. framework/modules/addressbook/controllers/addressController.php in Exponent CMS v2.4.0 allows remote attackers to read user information via a modified id number, as demonstrated b…CVE-2016-9285Exponentcms · 1.5% likely

   CWE-200

4. getUsersByJSON in framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0 allows remote attackers to read user information via users/getUsersByJSON/sort/ an…CVE-2016-9284Exponentcms · 1.5% likely

   CWE-200

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.