CVE-2016-9087

SQL injection vulnerability in framework/modules/filedownloads/controllers/filedownloadController.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the fileid parameter.

• CWE-89

• http://packetstormsecurity.com/files/139484/Exponent-CMS-2.3.9-SQL-Injection.htmlPatch, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2016/Nov/12Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/97271
• https://github.com/exponentcms/exponent-cms/commit/fdafb5ec97838e4edbd685f587f28d3174ebb3dbIssue Tracking, Patch, Third Party Advisory
• http://packetstormsecurity.com/files/139484/Exponent-CMS-2.3.9-SQL-Injection.htmlPatch, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2016/Nov/12Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/97271
• https://github.com/exponentcms/exponent-cms/commit/fdafb5ec97838e4edbd685f587f28d3174ebb3dbIssue Tracking, Patch, Third Party Advisory

Published

Mar 7, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-9081Joomla! 3.4.4 through 3.6.3 allows attackers to reset userna…
• CVE-2016-9082Integer overflow in the write_png function in cairo 1.14.6 a…
• CVE-2016-9083drivers/vfio/pci/vfio_pci.c in the Linux kernel through 4.8.…7.8
• CVE-2016-9084drivers/vfio/pci/vfio_pci_intrs.c in the Linux kernel throug…
• CVE-2016-9085Multiple integer overflows in libwebp allows attackers to ha…3.3
• CVE-2016-9086GitLab versions 8.9.x and above contain a critical security …
• CVE-2016-9091Blue Coat Advanced Secure Gateway (ASG) 6.6 before 6.6.5.4 a…
• CVE-2016-9092The Symantec Content Analysis (CA) 1.3, 2.x prior to 2.2.1.1…
• CVE-2016-9093A version of the SymEvent Driver that shipped with Symantec …
• CVE-2016-9094Symantec Endpoint Protection clients place detected malware …
• CVE-2016-9095Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-9096Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…