CVE Alert: CVE-2026-108900 – Exponent

A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early this disclosure but did not respond in any way.

**Risk verdict:** Prioritise internet-facing instances: public exploit code raises the likelihood of opportunistic attacks, but urgency cannot be calibrated against KEV, SSVC or EPSS because those indicators were not supplied.

**Why this matters:** Successful SQL injection could expose or alter information held in the CMS database, or disrupt the site. Attackers may seek user data, credentials or a foothold for further activity; the extent depends on the database account’s permissions and what information it can access.

**Most likely attack path:** An unauthenticated remote attacker can target the XML-RPC login function without user interaction or complex conditions. The reported impact remains within the vulnerable system’s security scope, so broader lateral movement is not implied; however, access to sensitive database records could enable follow-on attacks.

**Who is most exposed:** Publicly reachable CMS installations with XML-RPC enabled are most at risk, particularly sites whose database account has broad permissions.

Review web and reverse-proxy logs for unusual requests to `xmlrpc.php` and repeated login attempts.

Look for suspicious SQL errors, response anomalies or bursts of requests from one source.

Check database audit logs for unexpected reads, writes or authentication activity.

Mitigation and prioritisation:

Confirm vendor guidance and apply a fixed release when available; no remediation version is established by the supplied data.

If XML-RPC is not required, disable it or restrict access at the proxy or firewall.

Add SQL-injection filtering as a temporary layer, not a substitute for remediation.

Limit the CMS database account’s privileges; preserve logs and take a verified backup before changes.

Test mitigations in staging, then deploy through change control and monitor closely.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.