E1
Product
e107
78
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 10Medium 11Low 0
Watch
Add e107 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-72599 | 9.8 | Aug 11 | e107 e107 - SQL Injection Affected: through 2.4.0 |
| CVE-2021-27885 | 8.8 | Mar 2 | usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism Affected: through 2.3.0 |
| CVE-2016-10753 | 8.8 | May 24 | e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC Affected: 2.1.2 |
| CVE-2018-15901 | 8.8 | Aug 28 | e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including administrators Affected: 2.1.8 |
| CVE-2025-11941 | 8.1 | Oct 19 | e107 CMS Avatar image.php path traversal Affected: through 2.3.3 |
| CVE-2008-2020 | 7.5 | Apr 30 | The CAPTCHA implementation as used in (1) Francisco Burzi PHP-Nuke 7.0 and 8.1, (2) my123tkShop e-Commerce-Suite (aka 123tkShop) 0.9.1, (3) phpMyBitTorrent 1.2.2, (4) TorrentFlux… Affected: 0.7.11 |
| CVE-2022-50939 | 7.2 | Jan 13 | e107 CMS v3.2.1 - Upload Restriction Bypass with Path Traversal File Override Affected: 3.2.1 |
| CVE-2022-50916 | 7.2 | Jan 13 | e107 CMS v3.2.1 - Upload restriction bypass (Authenticated [Admin])+ Server file override Affected: 3.2.1 |
| CVE-2022-50907 | 7.2 | Jan 13 | e107 CMS v3.2.1 - Admin Upload Restriction Bypass + RCE Affected: 3.2.1 |
| CVE-2018-16388 | 7.2 | Sep 12 | e107_web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content type Affected: 2.1.8 |
| CVE-2016-10378 | 7.2 | May 29 | e107 2.1.1 allows SQL injection by remote authenticated administrators via the pagelist parameter to e107_admin/menus.php, related to the menuSaveVisibility function Affected: 2.1.1 |
| CVE-2025-61505 | 6.5 | Oct 10 | e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the `install.php` script Affected: through 2.3.3 |
| CVE-2018-16389 | 6.5 | Sep 12 | e107_admin/banlist.php in e107 2.1.8 allows SQL injection via the old_ip parameter Affected: 2.1.8 |
| CVE-2018-11127 | 6.5 | May 15 | e107 2.1.7 has CSRF resulting in arbitrary user deletion Affected: 2.1.7 |
| CVE-2017-8098 | 6.5 | Apr 24 | e107 2.1.4 is vulnerable to cross-site request forgery in plugin-installing, meta-changing, and settings-changing Affected: 2.1.4 |
| CVE-2022-50905 | 6.1 | Jan 13 | e107 CMS v3.2.1 - Reflected XSS via Comment Flow Affected: 3.2.1 |
| CVE-2018-11734 | 6.1 | Jul 10 | In e107 v2.1.7, output without filtering results in XSS Affected: 2.1.7 |
| CVE-2018-16381 | 6.1 | Sep 5 | e107 2.1.8 has XSS via the e107_admin/users.php?mode=main&action=list user_loginname parameter Affected: 2.1.8 |
| CVE-2023-36121 | 5.4 | Aug 2 | Cross Site Scripting vulnerability in e107 v.2.3.2 allows a remote attacker to execute arbitrary code via the description function in the SEO project Affected: 2.3.2 |
| CVE-2022-50906 | 4.8 | Jan 13 | e107 CMS v3.2.1 - Admin Upload Restriction Bypass + Stored XSS Affected: 3.2.1 |
| CVE-2018-17423 | 4.8 | Jun 19 | An issue was discovered in e107 v2.1.9 Affected: 2.1.9 |
| CVE-2018-17081 | 4.3 | Sep 26 | e107 2.1.9 allows CSRF via e107_admin/wmessage.php?mode=&action=inline&ajax_used=1&id= for changing the title of an arbitrary page Affected: 2.1.9 |
| CVE-2015-1057 | – | Jan 16 | Cross-site scripting (XSS) vulnerability in usersettings.php in e107 2.0.0 allows remote attackers to inject arbitrary web script or HTML via the "Real Name" value Affected: 2.0.0 |
| CVE-2015-1041 | – | Jan 15 | Cross-site scripting (XSS) vulnerability in e107_admin/filemanager.php in e107 1.0.4 allows remote attackers to inject arbitrary web script or HTML via the e107_files/ file path… Affected: 1.0.4 |
| CVE-2014-9459 | – | Jan 2 | Cross-site request forgery (CSRF) vulnerability in the AdminObserver function in e107_admin/users.php in e107 2.0 alpha2 allows remote attackers to hijack the authentication of… Affected: 2.0 |
| CVE-2014-4734 | – | Jul 21 | Cross-site scripting (XSS) vulnerability in e107_admin/db.php in e107 2.0 alpha2 and earlier allows remote attackers to inject arbitrary web script or HTML via the type parameter Affected: through 2.0; 2.0 |
| CVE-2013-7305 | – | Jan 22 | fpw.php in e107 through 1.0.4 does not check the user_ban field, which makes it easier for remote attackers to reset passwords by sending a pwsubmit request and leveraging access… Affected: through 1.0.4; 0.7.0; 0.7.1; 0.7.2; 0.7.3; 0.7.4; +23 more |
| CVE-2013-2750 | – | Jan 22 | Cross-site scripting (XSS) vulnerability in e107_plugins/content/handlers/content_preset.php in e107 before 1.0.3 allows remote attackers to inject arbitrary web script or HTML… Affected: through 1.0.2; 0.7.0; 0.7.1; 0.7.2; 0.7.3; 0.7.4; +21 more |
| CVE-2012-6434 | – | Jan 3 | Multiple cross-site request forgery (CSRF) vulnerabilities in e107_admin/download.php in e107 1.0.2 allow remote attackers to hijack the authentication of administrators for… Affected: 1.0.2 |
| CVE-2012-6433 | – | Jan 3 | Cross-site request forgery (CSRF) vulnerability in e107_admin/newspost.php in e107 1.0.1 allows remote attackers to hijack the authentication of administrators for requests that… Affected: 1.0.1 |
| CVE-2011-4947 | – | Aug 31 | Cross-site request forgery (CSRF) vulnerability in e107_admin/users_extended.php in e107 before 0.7.26 allows remote attackers to hijack the authentication of administrators for… Affected: through 0.7.24; 0.7; 0.7.0; 0.7.1; 0.7.2; 0.7.3; +19 more |
| CVE-2011-4946 | – | Aug 31 | SQL injection vulnerability in e107_admin/users_extended.php in e107 before 0.7.26 allows remote attackers to execute arbitrary SQL commands via the user_field parameter Affected: through 0.7.24; 0.7.0; 0.7.1; 0.7.2; 0.7.3; 0.7.4; +18 more |
| CVE-2012-3843 | – | Jul 3 | Cross-site scripting (XSS) vulnerability in the registration page in e107, probably 1.0.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: 1.0.1 |
| CVE-2010-5084 | – | Feb 14 | The cross-site request forgery (CSRF) protection mechanism in e107 before 0.7.23 uses a predictable random token based on the creation date of the administrator account, which… Affected: through 0.7.22; 0.6_10; 0.6_11; 0.6_12; 0.6_13; 0.6_14; +34 more |
| CVE-2011-4921 | – | Jan 4 | SQL injection vulnerability in usersettings.php in e107 0.7.26, and possibly other versions before 1.0.0, allows remote attackers to execute arbitrary SQL commands via the… Affected: 0.7.26 |
| CVE-2011-4920 | – | Jan 4 | Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.26, and other versions before 1.0.0, allow remote attackers to inject arbitrary web script or HTML via the URL to… Affected: 0.7.26 |
| CVE-2011-1513 | – | Nov 4 | Static code injection vulnerability in install_.php in e107 CMS 0.7.24 and probably earlier versions, when the installation script is not removed, allows remote attackers to… Affected: through 0.7.24; 0.7; 0.7.0; 0.7.1; 0.7.2; 0.7.3; +34 more |
| CVE-2011-3731 | – | Sep 23 | e107 0.7.24 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated… Affected: 0.7.24 |
| CVE-2010-4757 | – | Mar 15 | Cross-site scripting (XSS) vulnerability in submitnews.php in e107 before 0.7.23 allows remote attackers to inject arbitrary web script or HTML via the submitnews_title parameter,… Affected: through 0.7.22; 0.6_10; 0.6_11; 0.6_12; 0.6_13; 0.6_14; +34 more |
| CVE-2011-0457 | – | Mar 15 | Cross-site scripting (XSS) vulnerability in e107 0.7.22 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors Affected: through 0.7.22; 0.6_10; 0.6_11; 0.6_12; 0.6_13; 0.6_14; +34 more |
| CVE-2010-2099 | – | May 27 | bbcode/php.bb in e107 0.7.20 and earlier does not perform access control checks for all inputs that could contain the php bbcode tag, which allows remote attackers to execute… Affected: through 0.7.20; 0.6_10; 0.6_11; 0.6_12; 0.6_13; 0.6_14; +34 more |
| CVE-2010-2098 | – | May 27 | Incomplete blacklist vulnerability in usersettings.php in e107 0.7.20 and earlier allows remote attackers to conduct SQL injection attacks via the loginname parameter Affected: through 0.7.20; 0.6_10; 0.6_11; 0.6_12; 0.6_13; 0.6_14; +34 more |
| CVE-2010-0997 | – | Apr 20 | Cross-site scripting (XSS) vulnerability in 107_plugins/content/content_manager.php in the Content Management plugin in e107 before 0.7.20, when the personal content manager is… Affected: through 0.7.19; 0.7.0; 0.7.1; 0.7.2; 0.7.3; 0.7.4; +14 more |
| CVE-2010-0996 | – | Apr 20 | Unrestricted file upload vulnerability in e107 before 0.7.20 allows remote authenticated users to execute arbitrary code by uploading a .php.filetypesphp file Affected: through 0.7.19; 0.7; 0.7.1; 0.7.2; 0.7.3; 0.7.4; +34 more |
| CVE-2009-4084 | – | Nov 29 | SQL injection vulnerability in the search feature in e107 0.7.16 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors Affected: through 0.7.16; 0.6_10; 0.6_11; 0.6_12; 0.6_13; 0.6_14; +34 more |
| CVE-2009-4083 | – | Nov 29 | Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.16 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in (1)… Affected: through 0.7.16; 0.6_10; 0.6_11; 0.6_12; 0.6_13; 0.6_14; +34 more |
| CVE-2009-3444 | – | Sep 28 | Cross-site scripting (XSS) vulnerability in email.php in e107 0.7.16 and earlier allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header in a… Affected: through 0.7.16; 0.6_10; 0.6_11; 0.6_12; 0.6_13; 0.6_14; +34 more |
| CVE-2009-1409 | – | Apr 24 | SQL injection vulnerability in usersettings.php in e107 0.7.15 and earlier, when "Extended User Fields" is enabled and magic_quotes_gpc is disabled, allows remote attackers to… Affected: 0.6_10; 0.6_11; 0.6_12; 0.6_13; 0.6_14; 0.6_15; +34 more |
| CVE-2008-6208 | – | Feb 20 | Cross-site scripting (XSS) vulnerability in submitnews.php in e107 CMS 0.7.11 allows remote attackers to inject arbitrary web script or HTML via the (1) author_name, (2)… Affected: 0.7.11 |
| CVE-2008-5320 | – | Dec 3 | SQL injection vulnerability in usersettings.php in e107 0.7.13 and earlier allows remote authenticated users to execute arbitrary SQL commands via the ue[] parameter Affected: through 0.7.13; 0.7; 0.7.1; 0.7.2; 0.7.3; 0.7.4; +34 more |