CVE-2026-108900: Exponent CMS XML-RPC xmlrpc.php userLogin sql injection
A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for investigation?
Exponent CMS deployments running versions up to 3.0.2patch2 should be treated as affected, particularly where the XML-RPC endpoint is reachable over the network.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction.
What is the likely impact of successful exploitation?
The reported SQL injection can affect confidentiality, integrity, and availability, each with a low impact rating. The vulnerability is rated high severity with a 7.3 CVSS score.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used. The vendor was contacted but did not respond, according to the report.