Whole CMS Is Vulnerable To Reflected XSS

Hey Exponent CMS

want to report critical conditions of your cms , that your whole cms is vulnerable to Reflected XSS Attack

how ?
Lets see

suppose you heve this ur - http://127.0.0.1/exponent/users/userperms/mod/navigation/int/1

then you just have to xss payload at the end of the url - like this
http://127.0.0.1/exponent/users/userperms/mod/navigation/int/1&quot...;

every single page which have no parameter is vulnerable to same attack

just add "> in every single page which have no xss and you will get the js alert box