Unscored severity · published Jun 27, 2006
CVE-2006-3259
Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.5 allow remote attackers to inject arbitrary web script or HTML via the (1) ep parameter to search.php and the (2)…
–
CVSS
4.3%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.5 allow remote attackers to inject arbitrary web script or HTML via the (1) ep parameter to search.php and the (2) subject parameter in comment.php (aka the Subject field when posting a comment).
Exploitation
Is it being used?
Exploit prediction (EPSS)4.3% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
E1
E107 · E107
through 0.7.5; 0.6_10; 0.6_11; 0.6_12; 0.6_13; 0.6_14; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2006-3259
CVE.org
https://www.cve.org/CVERecord?id=CVE-2006-3259
Exploit
http://secunia.com/advisories/20727
securityreason.com
http://securityreason.com/securityalert/1151
www.securityfocus.com
http://www.securityfocus.com/archive/1/437649/100/0/threaded
www.securityfocus.com
http://www.securityfocus.com/bid/18508
Exploit
http://www.securityfocus.com/bid/18560
www.vupen.com
http://www.vupen.com/english/advisories/2006/2460
More from E107
9.8
CVE-2026-72599
e107 e107 - SQL Injection
8.8
CVE-2021-27885
usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism
8.8
CVE-2016-10753
e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC
8.8
CVE-2018-15901
e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including administrators
8.1
CVE-2025-11941
e107 CMS Avatar image.php path traversal