https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 10:45:28 +0000 https://vulnerability.circl.lu/vuln/cnvd-2016-11166 cnvd-2016-11166 https://vulnerability.circl.lu/vuln/cnvd-2016-11166 https://vulnerability.circl.lu/vuln/fkie_cve-2016-9288 <p>In framework/modules/navigation/controllers/navigationController.php in Exponent CMS v2.4.0 or older, the parameter &#34;target&#34; of function &#34;DragnDropReRank&#34; is directly used without any filtration which caused SQL injection. The payload can be used like this: /navigation/DragnDropReRank/target/1.</p> <p>In framework/modules/navigation/controllers/navigationController.php in Exponent CMS v2.4.0 or older, the parameter &#34;target&#34; of function &#34;DragnDropReRank&#34; is directly used without any filtration which caused SQL injection. The payload can be used like this: /navigation/DragnDropReRank/target/1.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2016-9288 https://vulnerability.circl.lu/vuln/ghsa-7xgm-jxp3-q6jg <p>In framework/modules/navigation/controllers/navigationController.php in Exponent CMS v2.4.0 or older, the parameter &#34;target&#34; of function &#34;DragnDropReRank&#34; is directly used without any filtration which caused SQL injection. The payload can be used like this: /navigation/DragnDropReRank/target/1.</p> <p>In framework/modules/navigation/controllers/navigationController.php in Exponent CMS v2.4.0 or older, the parameter &#34;target&#34; of function &#34;DragnDropReRank&#34; is directly used without any filtration which caused SQL injection. The payload can be used like this: /navigation/DragnDropReRank/target/1.</p> https://vulnerability.circl.lu/vuln/ghsa-7xgm-jxp3-q6jg https://vulnerability.circl.lu/vuln/gsd-2016-9288 gsd-2016-9288 https://vulnerability.circl.lu/vuln/gsd-2016-9288