{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/exponent-cms--3.0.2patch2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:exponentcms:exponent_cms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-108900"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Exponent CMS (\u003c= 3.0.2patch2)"],"_cs_severities":["high"],"_cs_tags":["sqli","web-application","cms","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Exponent CMS"],"content_html":"\u003cp\u003eA critical security vulnerability has been identified in Exponent CMS versions up to 3.0.2patch2. The flaw exists within the userLogin function located in the xmlrpc.php file, which is part of the system's XML-RPC component. This vulnerability is classified as a SQL injection (SQLi) issue that can be triggered remotely by an unauthenticated attacker. The vulnerability stems from improper sanitization of input provided to the XML-RPC interface. Since a public exploit for this vulnerability exists and the vendor has not provided a patch, installations running affected versions are at high risk of database compromise, including unauthorized data exfiltration or potential administrative account takeover. Defenders should prioritize auditing web server access logs for anomalous traffic targeting xmlrpc.php and evaluate migrating or isolating instances of Exponent CMS.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-108900 allows an unauthenticated remote attacker to execute arbitrary SQL commands against the underlying database. This could lead to full unauthorized access to sensitive application data, modification of user credentials, or database manipulation. The impact is severe, particularly as the vulnerability is publicly disclosed and likely being targeted by automated scanners or opportunistic threat actors.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor web server logs for HTTP requests targeting the /xmlrpc.php endpoint, specifically looking for abnormal strings associated with SQL injection payloads (e.g., SELECT, UNION, WAITFOR, or sleep commands).\u003c/li\u003e\n\u003cli\u003eIf possible, restrict access to the xmlrpc.php file at the web server (Nginx/Apache) level or block the file entirely if XML-RPC functionality is not required for site operations.\u003c/li\u003e\n\u003cli\u003eAudit web application logs to detect unauthorized calls to the userLogin function within the XML-RPC component.\u003c/li\u003e\n\u003cli\u003eSince no vendor patch is currently available, evaluate if the CMS instance can be migrated to a secure platform or placed behind a Web Application Firewall (WAF) with specific rulesets designed to block SQL injection attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T18:32:13Z","date_published":"2026-10-12T18:32:13Z","id":"https://feed.craftedsignal.io/briefs/2026-10-exponent-cms-sqli/","summary":"Exponent CMS versions up to 3.0.2patch2 contain a SQL injection vulnerability in the userLogin function within xmlrpc.php that allows unauthenticated remote attackers to execute arbitrary SQL commands.","title":"SQL Injection in Exponent CMS XML-RPC Component","url":"https://feed.craftedsignal.io/briefs/2026-10-exponent-cms-sqli/"}],"language":"en","title":"CraftedSignal Threat Feed - Exponent CMS (\u003c= 3.0.2patch2)","version":"https://jsonfeed.org/version/1.1"}