Exponent CMS version 0.95 is susceptible to full path disclosure and cross site scripting vulnerabilities.