Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

Exponent CMS image gallery may allow harmful file uploads

CVE-2005-3764 · published 20 years ago
Summary

The image gallery feature in Exponent CMS version 0.96.3 and newer does not correctly verify the type of files users upload. This could let an attacker place a specially crafted file that runs unwanted code when the preview icon is shown. Apply any available updates from the vendor and ensure file‑type checks are enforced for all uploads.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
exponent exponent 0.94
0.95
0.96.1
0.96.3
0.96.4
cpe:2.3:a:exponent:exponent:0.94:*:*:*:*:*:*:*
Original advisory text
The image gallery (imagegallery) component in Exponent CMS 0.96.3 and later versions does not properly check the MIME type of uploaded files, with unknown impact from the preview icon, possibly inv...
The image gallery (imagegallery) component in Exponent CMS 0.96.3 and later versions does not properly check the MIME type of uploaded files, with unknown impact from the preview icon, possibly involving injection of HTML.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
10.0 Critical
Exploitation
1% chance of attack within 30 days
Timeline
Published22 Nov 2005
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2005-3764 · NVD
Track software like this
Free during beta