CVE-2015-8684

Exponent CMS before 2.3.7 does not properly restrict the types of files that can be uploaded, which allows remote attackers to conduct cross-site scripting…

published January 18, 2017

CVSS
—
EPSS
1%
Percentile
68.5
In the wild
Unconfirmed
What it is

Exponent CMS before 2.3.7 does not properly restrict the types of files that can be uploaded, which allows remote attackers to conduct cross-site scripting (XSS) attacks and possibly have other unspecified impact as demonstrated by uploading a file with an .html extension, then accessing it via the elFinder functionality.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01229 · 68.5th percentile
Published
2017-01-18T17:00Z
EPSS history
Timeline
  • 18 JAN 17:00Z
    Exponent CMS before 2.3.7 does not properly restrict the types of files that can be uploaded, which allows remote attackers to conduct cross-site scripting…
    cvelistv5