CVE-2026-108900

HIGH 7.3

Exponent CMS XML-RPC xmlrpc.php userLogin sql injection

CVSS Score

7.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CWE	CWE-89 CWE-74
Vendor	exponent
Product	cms
Published	Oct 12, 2026

Stay Ahead of the Next One

Get instant alerts for exponent cms

Be the first to know when new high vulnerabilities affecting exponent cms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

Exponent / CMS

3.0.2patch1 3.0.2patch2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/416691 vuldb.com: https://vuldb.com/vuln/416691/cti vuldb.com: https://vuldb.com/cve/CVE-2026-108900 vuldb.com: https://vuldb.com/submit/976950 github.com: https://github.com/dddwmr/CVE/blob/main/SQL%20Injection%20in%20xmlrpc.php%20userLogin%20username%20handling%20when%20USE_XMLRPC%20is%20enabled.md

Credits

🔍 dwmm (VulDB User) VulDB CNA Team