CVE-2026-108900: SQL Injection Vulnerability in Exponent CMS

github.com

CVE-2026-108900: SQL Injection Vulnerability in Exponent CMS

First seen 13 Oct 2026, 11:30 UTC • •57.1

Article Content

1 / 5

Browse articles

ThreatCluster •October 13, 2026 at 13:30 UTC

•CVE-2026-108900 affects Exponent CMS versions up to 3.0.2patch2.
•The vulnerability allows unauthenticated remote SQL injection via xmlrpc.php.
•Public exploit code increases the risk of opportunistic attacks on exposed systems.

A SQL injection vulnerability (CVE-2026-108900) has been identified in Exponent CMS versions up to 3.0.2patch2, specifically affecting the userLogin function in xmlrpc.php. This vulnerability allows unauthenticated remote attackers to manipulate SQL queries, potentially exposing or altering sensitive information in the CMS database. The exploit has been publicly disclosed, raising the risk of opportunistic attacks, particularly against internet-facing instances with XML-RPC enabled. The vendor was contacted prior to the disclosure but did not respond. Mitigation recommendations include disabling XML-RPC if not needed and applying SQL-injection filtering as a temporary measure. The vulnerability has a CVSS score of 6.9, indicating a medium severity level. Affected systems should monitor logs for unusual activity and limit database account privileges.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated just now How this analysis works

Timeline

2026-10-12

CVE-2026-108900 published

A SQL injection vulnerability in Exponent CMS was publicly disclosed with a CVSS score of 6.9.

Redpacketsecurity

More articles in this cluster (4)

Threat Graph

5 entities, 4 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Sql Injection
T1190 - Exploit Public-Facing Application

Vulnerability (1)

CVE-2026-108900

Weakness (1)

CWE-89 - SQL Injection

Affected Platform (1)

Exponent CMS

Relationships

CVE-2026-108900 targets Exponent CMS
Sql Injection targets Exponent CMS
T1190 - Exploit Public-Facing Application targets Exponent CMS
CVE-2026-108900 related to CWE-89 - SQL Injection

Following this threat?

Track CVE-2026-108900 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Common questions

Which versions of Exponent CMS are affected?

Exponent CMS versions up to 3.0.2patch2 are affected by this vulnerability.

Is there a patch available for this vulnerability?

No fixed release has been established yet, and the vendor has not responded to inquiries.

What immediate actions should be taken?

Disable XML-RPC if not needed, apply SQL-injection filtering, and monitor logs for unusual activity.

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…