CVE-2016-7452

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 could be used to upload a malicious file to any folder on the site via a cpi directory traversal.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/93045Third Party Advisory, VDB Entry
https://github.com/exponentcms/exponent-cms/commit/c1092f167cc6c78dc8bf9bf149946c5219413df3Issue Tracking, Patch
https://github.com/exponentcms/exponent-cms/releases/tag/v2.4.0
http://www.securityfocus.com/bid/93045Third Party Advisory, VDB Entry
https://github.com/exponentcms/exponent-cms/commit/c1092f167cc6c78dc8bf9bf149946c5219413df3Issue Tracking, Patch
https://github.com/exponentcms/exponent-cms/releases/tag/v2.4.0

Timeline

Published: Nov 3, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-74539.8The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 could be used to perform an fid SQL Injection.CVE-2016-74548.0CSRF vulnerability on Technicolor TC dpc3941T (formerly Cisco dpc3941T) devices with firmware dpc3941-P20-18-v303r20421733-160413a-CMCST all CVE-2016-74569.8VMware vSphere Data Protection (VDP) 5.5.x though 6.1.x has an SSH private key with a publicly known password, which makes it easier for rem CVE-2016-745710.0VMware vRealize Operations (aka vROps) 6.x before 6.4.0 allows remote authenticated users to gain privileges, or halt and remove virtual mac CVE-2016-74585.8VMware vSphere Client 5.5 before U3e and 6.0 before U2a allows remote vCenter Server and ESXi instances to read arbitrary files via an XML d CVE-2016-74597.7VMware vCenter Server 5.5 before U3e and 6.0 before U2a allows remote authenticated users to read arbitrary files via a (1) Log Browser, (2)CVE-2016-74609.1The Single Sign-On feature in VMware vCenter Server 5.5 before U3e and 6.0 before U2a and vRealize Automation 6.x before 6.2.5 allows remote CVE-2016-74618.8The drag-and-drop (aka DnD) function in VMware Workstation Pro 12.x before 12.5.2 and VMware Workstation Player 12.x before 12.5.2 and VMwar CVE-2016-74628.5The Suite REST API in VMware vRealize Operations (aka vROps) 6.x before 6.4.0 allows remote authenticated users to write arbitrary content t CVE-2016-74635.4Cross-site scripting (XSS) vulnerability in the Host Client in VMware vSphere Hypervisor (aka ESXi) 5.5 and 6.0 allows remote authenticated CVE-2016-74666.0Memory leak in the usb_xhci_exit function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator), when the xhci uses msix, allows local guest OS CVE-2016-74675.3The TMM SSO plugin in F5 BIG-IP APM 12.0.0 - 12.1.1, 11.6.0 - 11.6.1 HF1, 11.5.4 - 11.5.4 HF2, when configured as a SAML Identity Provider w