Exponent's Latest News

This version, code-named 'Limited Lockdown' fixes many security issues in all previous versions and adds screen reader (accessibility) support. We strongly encourage all Exponent installations be upgraded to v2.4.0 as soon as practical!

There are several security vulnerabilities in all versions of Exponent 2.x found in September and October, 2016, reported by a number of individuals including:Manuel Garcia Cardenas, the PKAV TEAM, fyth, felixk3y, DM_, obfusor, xiaoL, ylgaaaaa, Tomato, wooeast, and xiojunjie, These vulnerabilities could allow possible SQL injections, remote file exploits, RCE, XSS, changes to configurations, and other issues. They have been present in all versions of Exponent (2.x). The fix is:

This patch fixes several issues in the v2.3.9 release. It also provides several tweaks and new features including a 'fill screen' feature for the elFinder file manager, though the main focus is providing several security fixes. Patch #1 to v2.3.9 is found at http://sourceforge.net/projects/exponentcms/files/exponent-2.3.9-patch-1.zip/download​

Though they are both extremely old versions, they were the release before a major version change and are/may still be in use. Please bear in mind we strongly recommend your installations be updated to a much newer version which contains many more fixes and new features. Having said that, these patches (v2.1.4patch11 and v2.2.3patch14) fix security vulnerabilities reported by Manuel Garcia Cardenas and PKAV TEAM which could allow possible SQL injections.

There is a security vulnerability in Exponent 2.x found on September 12, 2016 and reported by Manuel Garcia Cardenas which could allow a possible SQL injection. Although the server and site setup to allow such an attack (in the real world) is very rare, it is none-the-less a vulnerability. It has been present in all versions of Exponent (2.x). The fix is:

This version, code-named 'Sultry Summer' fixes many issues in the previous version(s) and adds several new features. There is a new dynamic drag-n-drop form designer for Twitter Bootstrap 3 based themes which greatly speeds up form design. It also provides much better support for small devices when using a Twitter Bootstrap 3 based theme. Other major include:

There is a security vulnerability in Exponent 2.x found on August 26, 2016 reported by Balisong which could allow uploaded scripts to be executed. It has been present in all versions of Exponent (2.x). The fix is:

Though they are both extremely old versions, they were the release before a major version change and are/may still be in use. Please bear in mind we strongly recommend your installations be updated to a much newer version which contains many more fixes and new features. Having said that, these patches (v2.1.4patch9 and v2.2.3patch12) fix a security vulnerability reported by Balisong which might allow uploaded scripts to be executed.

This patch is released to address a fix for the traditional file manager file uploaded which has been broken on Bootstrap based themes. It also addresses some specific issues in the v2.3.8, v2.3.8 Patch #1, v2.3.8patch #2, v2.3.8 Patch #3, v2.3.8 Patch #4, and v2.3.8 Patch #5 releases.

Hot on the heals of its predecessor, this patch fixes some specific issues in the v2.3.8, v2.3.8 Patch #1, v2.3.8patch #2, v2.3.8 Patch #3, and v2.3.8 Patch #4 releases. Specifically: