CVE-2016-7095: Exponent CMS before 2.3.9 is vulnerable to an attacker uploading a malicious script file using redirection...

Security readout for executives and security teams

Exponent CMS versions before 2.3.9 could let an attacker upload a malicious script into a folder where the server may execute it. If an exposed site still runs an affected version, the business risk is compromise of the web application and possibly the hosting environment. Exposure is likely limited to internet-facing or internally reachable Exponent CMS installations running versions before 2.3.9, especially where file upload functionality is enabled. Treat this as high priority for any remaining Exponent CMS deployment. The issue is old, but legacy CMS exposure with executable uploads can lead to serious site compromise. Mitigation focus: Inventory Exponent CMS deployments and identify versions before 2.3.9.; Follow Exponent CMS vendor guidance and upgrade beyond the vulnerable release line.; Restrict upload functionality to trusted users where business workflows allow..

Prepared

Jun 13, 2026, 13:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.