ExponentCMS <= 2.6 - Host Header Injection
An HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponent_constants.php. A modified HTTP header can change links on the webpage to an arbitrary value,leading to a possible attack vector for MITM.
PoC 已收录exponentcms
CVSS4.3EPSS 2.5%