CVE-2016-2242

Exponent CMS 2.x before 2.3.7 Patch 3 allows remote attackers to execute arbitrary code via the sc parameter to install/index.php.

• CWE-94

• http://packetstormsecurity.com/files/135721/Exponent-2.3.7-PHP-Code-Execution.htmlExploit, Patch, Third Party Advisory
• http://www.exponentcms.org/news/patch-3-released-for-v2-3-7Release Notes, Vendor Advisory
• http://www.exponentcms.org/news/show/title/security-notice-closing-an-exponent-security-vulnerabilityExploit, Mitigation, Patch, Vendor Advisory
• http://www.securityfocus.com/archive/1/537499/100/0/threaded
• https://www.htbridge.com/advisory/HTB23290Exploit, Patch, Third Party Advisory
• http://packetstormsecurity.com/files/135721/Exponent-2.3.7-PHP-Code-Execution.htmlExploit, Patch, Third Party Advisory
• http://www.exponentcms.org/news/patch-3-released-for-v2-3-7Release Notes, Vendor Advisory
• http://www.exponentcms.org/news/show/title/security-notice-closing-an-exponent-security-vulnerabilityExploit, Mitigation, Patch, Vendor Advisory
• http://www.securityfocus.com/archive/1/537499/100/0/threaded
• https://www.htbridge.com/advisory/HTB23290Exploit, Patch, Third Party Advisory

Published

Jan 23, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-2226Integer overflow in the string_appends function in cplus-dem…
• CVE-2016-2228Cross-site scripting (XSS) vulnerability in horde/templates/…
• CVE-2016-2230OpenELEC and RasPlex devices have a hardcoded password for t…
• CVE-2016-2231The Windows-based Host Interface Program (WHIP) service on H…
• CVE-2016-2232Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 1…
• CVE-2016-2233Stack-based buffer overflow in the inbound_cap_ls function i…
• CVE-2016-2243Sure Start on HP Commercial PCs 2015 allows local users to c…
• CVE-2016-2244HP LaserJet printers and MFPs and OfficeJet Enterprise print…
• CVE-2016-2245HP Support Assistant before 8.1.52.1 allows remote attackers…
• CVE-2016-2246HP ThinPro 4.4 through 6.1 mishandles the keyboard layout co…
• CVE-2016-2247Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2016-2248Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…