Description
A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-10-12
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: SQL Injection
Action: Immediate Patch
AI Analysis

Impact

A flaw in the userLogin function of Exponent CMS’s XML‑RPC interface allows remote injection of SQL statements through the username field when XML‑RPC support is enabled. The vulnerability can be triggered from any external host and may lead to disclosure or modification of the database contents, compromising confidentiality and integrity. The weakness is categorized as CWE-74 and CWE-89.

Affected Systems

Exponent CMS versions up to and including 3.0.2patch2 are affected. The issue resides in the xmlrpc.php component that handles user login requests.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity, yet the flaw is publicly disclosed and can be exploited remotely without prior authentication. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the public availability of the exploit suggests a tangible risk to systems still running the vulnerable versions. The attack vector is remote, originating from internet‑exposed XML‑RPC endpoints.

Generated by OpenCVE AI on October 12, 2026 at 16:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Exponent CMS patch or upgrade to a version later than 3.0.2patch2 that addresses the SQL injection in xmlrpc.php userLogin.
  • If upgrading is not immediately possible, configure the CMS to disable XML‑RPC functionality or remove access to xmlrpc.php so that the vulnerable code is not reachable from external hosts.
  • Implement firewall or network segmentation rules that restrict traffic to the XML‑RPC endpoint, ensuring only trusted internal networks can contact it, and verify that the USE_XMLRPC setting is set to false in the configuration.

Generated by OpenCVE AI on October 12, 2026 at 16:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 15 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Exponent CMS XML-RPC xmlrpc.php userLogin sql injection
First Time appeared Exponent
Exponent cms
Weaknesses CWE-74
CWE-89
CPEs cpe:2.3:a:exponent:cms:*:*:*:*:*:*:*:*
Vendors & Products Exponent
Exponent cms
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 7.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Exponent Cms
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-15T15:14:57.119Z

Reserved: 2026-10-11T14:43:42.432Z

Link: CVE-2026-108900

cve-icon Vulnrichment

Updated: 2026-10-15T14:52:31.297Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T16:17:03.533

Modified: 2026-10-15T16:17:39.460

Link: CVE-2026-108900

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T19:30:06Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')