Which products and versions are affected by CVE-2021-38751?

Affected: Exponentcms. The full list is in the CVE brief.

Is CVE-2021-38751 being exploited in the wild?

It is not listed in any known-exploited vulnerabilities catalog.

Is CVE-2021-38751 in the CISA KEV catalog?

No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Is there a public exploit for CVE-2021-38751?

No public exploit code is known.

Is there a fix for CVE-2021-38751?

Fixed versions are available, including Exponentcms 2.6.

How urgently should CVE-2021-38751 be patched?

Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.

Request A Demo

Vulnerability Intelligence

CVE-2021-38751

Medium

A HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponent_constants.php.

Published Aug 16, 2021 · Updated Jul 8, 2026

Key Facts

Routine patching

CVE-2021-38751 is a medium-severity vulnerability (CVSS 4.3 v3.1) affecting Exponentcms.
It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
EPSS estimates a 2.5% probability of exploitation in the next 30 days.
Fixed versions are available, including Exponentcms 2.6.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.

CVSS v3.1

4.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS (30-day exploit likelihood)

2.5%

Higher than 84.2% of all scored CVEs

Exploited in the wild

No known

Not in a known-exploited catalog

Public exploit code

None known

Get the full CVE-2021-38751 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

A HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponent_constants.php. A modified HTTP header can change links on the webpage to an arbitrary value, leading to a possible attack vector for MITM.

Affected Products

1 affected entries in total

Product	Affected versions	Fixed in
ExponentcmsExponentcms	See advisory	2.6

Patched Releases

Exponentcms

2.6

Timeline

Publicly disclosed
Aug 16, 2021
Last updated
Jul 8, 2026

Weakness Type

CWE-116 Improper Encoding or Escaping of Output

References

exploithttps://github.com/exponentcms/exponent-cms/issues/1544

FAQ

Common Questions.

A HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponent_constants.php.
Affected: Exponentcms. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Exponentcms 2.6.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.

Is CVE-2021-38751 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.