Exponent CMS 2.6.0 patch2 allows an
authenticated user to inject Javascript code on the User-Agent when
logging in.
When an administrator user visits the 'User Sessions' tab, the
Javascript will be triggered allowing an attacker to compromise the
administrator session.
With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your
email and much more.
