CVE-2026-108900: SQL Injection in Exponent CMS

An SQL injection vulnerability (CVE-2026-108900) affects Exponent CMS versions 3.0.2patch1 and 3.0.2patch2. The issue resides in the userLogin function of the xmlrpc.php file in the XML-RPC component. Remote attackers can exploit this flaw to inject malicious SQL commands, potentially leading to unauthorized data access or modification. The vulnerability has been publicly disclosed, but the vendor has not provided a response or patch. The CVSS 4.0 base score is 6.9, indicating medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality, integrity, and availability impacts.

Successful exploitation of this vulnerability can allow remote attackers to execute arbitrary SQL commands on the backend database via the userLogin function, potentially leading to unauthorized data access or modification. The impact is rated medium severity with limited confidentiality, integrity, and availability impacts as per the CVSS 4.0 vector. There is no indication of active exploitation in the wild at this time.

No official patch or remediation guidance is currently available from the vendor. Users of affected versions (3.0.2patch1 and 3.0.2patch2) should consider disabling or restricting access to the XML-RPC component, especially the userLogin function, until a fix is released. Monitor vendor channels for updates and apply patches promptly once available.