CVE-2022-23049 | BDVDB-2026-169672 Detail

Description#

Exponent CMS 2.6.0patch2 allows an authenticated user to inject persistent JavaScript code on the "User-Agent" header when logging in. When an administrator user visits the "User Sessions" tab, the JavaScript will be triggered allowing an attacker to compromise the administrator session.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12022-02-09Record published in the CVE List.
2. Version 22024-08-03Most recent update recorded in the CVE List.