eXV2 CMS versions 2.0.4.3 and below suffer from cross site scripting and session fixation vulnerabilities.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/55664/major_rls38.txt
Source: https://packetstormsecurity.com/files/55664/major_rls38.txt.html