Vendor
Exponent CMS versions up to 3.0.2patch2 contain a SQL injection vulnerability in the userLogin function within xmlrpc.php that allows unauthenticated remote attackers to execute arbitrary SQL commands.