CVE-2021-32441

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-02-17 · updated 2026-06-17
Weakness: CWE-89

Description

SQL Injection vulnerability in Exponent-CMS v.2.6.0 fixed in 2.7.0 allows attackers to gain access to sensitive information via the selectValue function in the expConfig class.

Affected products

Exponent CMS: from 2.6.0 before 2.7.0 — fixed in 2.7.0

How to fix

Upgrade to a fixed version: Exponent CMS 2.7.0. Check the vendor advisory for mitigations.

References

https://github.com/exponentcms/exponent-cms/issues/1542
https://github.com/pang0lin/CVEproject/blob/main/ExponentCMS_v2.6.0_sqli.md
https://github.com/exponentcms/exponent-cms/issues/1542
https://github.com/pang0lin/CVEproject/blob/main/ExponentCMS_v2.6.0_sqli.md

Get alerted when CVE-2021-32441 or the next vulnerability affects your stack