E1
Product
e107
78
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 10Medium 11Low 0
Watch
Add e107 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2008-1989 | – | Apr 27 | PHP remote file inclusion vulnerability in 123flashchat.php in the 123 Flash Chat 6.8.0 module for e107, when register_globals is enabled, allows remote attackers to execute… Affected: All versions, or not specified |
| CVE-2007-3429 | – | Jun 27 | Unrestricted file upload vulnerability in signup.php in e107 0.7.8 and earlier, when photograph upload is enabled, allows remote attackers to upload and execute arbitrary PHP code… Affected: 0.7; 0.7.1; 0.7.2; 0.7.3; 0.7.4; 0.7.5; +3 more |
| CVE-2006-5786 | – | Nov 7 | Directory traversal vulnerability in class2.php in e107 0.7.5 and earlier allows remote attackers to read and execute PHP code in arbitrary files via ".." sequences in the… Affected: 0.7.5 |
| CVE-2006-4794 | – | Sep 14 | Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.5 allow remote attackers to inject arbitrary web script or HTML via the query string (PATH_INFO) in (1)… Affected: 0.7.5 |
| CVE-2006-4757 | – | Sep 13 | Multiple SQL injection vulnerabilities in the admin section in e107 0.7.5 allow remote authenticated administrative users to execute arbitrary SQL commands via the (1)… Affected: through 0.7.5; 0.6_10; 0.6_11; 0.6_12; 0.6_13; 0.6_14; +34 more |
| CVE-2006-4548 | – | Sep 6 | e107 0.75 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows… Affected: 0.7; 0.7.1; 0.7.2; 0.7.3; 0.7.4; 0.7.5 |
| CVE-2006-3259 | – | Jun 27 | Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.5 allow remote attackers to inject arbitrary web script or HTML via the (1) ep parameter to search.php and the (2)… Affected: through 0.7.5; 0.6_10; 0.6_11; 0.6_12; 0.6_13; 0.6_14; +34 more |
| CVE-2006-2590 | – | May 25 | SQL injection vulnerability in e107 before 0.7.5 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors Affected: 0.7.5 |
| CVE-2006-2591 | – | May 25 | Unspecified vulnerability in e107 before 0.7.5 has unknown impact and remote attack vectors related to an "emailing exploit" Affected: 0.7.5 |
| CVE-2006-2416 | – | May 16 | SQL injection vulnerability in class2.php in e107 0.7.2 and earlier allows remote attackers to execute arbitrary SQL commands via a cookie as defined in $pref['cookie_name'] Affected: 0.6_10; 0.6_11; 0.6_12; 0.6_13; 0.6_14; 0.6_15; +12 more |
| CVE-2006-0857 | – | Feb 23 | Cross-site scripting (XSS) vulnerability in Chatbox Plugin 1.0 in e107 0.7.2 allows remote attackers to inject arbitrary HTML or web script via a Chatbox, as demonstrated using a… Affected: 0.7.2 |
| CVE-2006-0682 | – | Feb 15 | Multiple cross-site scripting (XSS) vulnerabilities in bbcodes system in e107 before 0.7.2 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors Affected: 0.7; 0.7.1; 0.547_beta; 0.548_beta; 0.549_beta; 0.551_beta; +34 more |
| CVE-2005-4224 | – | Dec 14 | Multiple "potential" SQL injection vulnerabilities in e107 0.7 might allow remote attackers to execute arbitrary SQL commands via (1) the email, hideemail, image, realname,… Affected: 0.7 |
| CVE-2005-4051 | – | Dec 7 | e107 0.6174 allows remote attackers to vote multiple times for a download via repeated requests to rate.php Affected: 0.6174 |
| CVE-2005-3594 | – | Nov 16 | game_score.php in e107 allows remote attackers to insert high scores via HTTP POST methods utilizing the $player_name, $player_score, and $game_name variables Affected: All versions, or not specified |
| CVE-2005-3521 | – | Nov 6 | SQL injection vulnerability in resetcore.php in e107 0.617 through 0.6173 allows remote attackers to execute arbitrary SQL commands, bypass authentication, and inject HTML or… Affected: 0.617; 0.6171; 0.6172 |
| CVE-2005-2805 | – | Sep 6 | forum_post.php in e107 0.6 allows remote attackers to post to non-existent forums by modifying the forum number Affected: 0.603; 0.616; 0.617 |
| CVE-2005-2559 | – | Aug 16 | doping.php in ePing plugin 1.02 and earlier for e107 portal allows remote attackers to execute arbitrary code or overwrite files via (1) shell metacharacters in the eping_count… Affected: All versions, or not specified |
| CVE-2005-2327 | – | Jul 20 | Cross-site scripting (XSS) vulnerability in e107 0.617 and earlier allows remote attackers to inject arbitrary web script or HTML via nested [url] BBCode tags Affected: 0.547_beta; 0.548_beta; 0.549_beta; 0.551_beta; 0.552_beta; 0.553_beta; +31 more |
| CVE-2005-1949 | – | Jun 16 | The eping_validaddr function in functions.php for the ePing plugin for e107 portal allows remote attackers to execute arbitrary commands via shell metacharacters after a valid… Affected: All versions, or not specified |
| CVE-2005-1966 | – | Jun 10 | The eTrace_validaddr function in eTrace plugin for e107 portal allows remote attackers to execute arbitrary commands via shell metacharacters after a valid argument to the… Affected: 1.0.1 |
| CVE-2004-2262 | – | Dec 31 | ImageManager in e107 before 0.617 does not properly check the types of uploaded files, which allows remote attackers to execute arbitrary code by uploading a PHP file via the… Affected: before 0.617 |
| CVE-2004-2040 | – | May 29 | Multiple cross-site scripting (XSS) vulnerabilities in e107 0.615 allow remote attackers to inject arbitrary web script or HTML via the (1) LAN_407 parameter to clock_menu.php,… Affected: 0.6_15; 0.6_15a |
| CVE-2004-2042 | – | May 29 | Multiple SQL injection vulnerabilities in e107 0.615 allow remote attackers to inject arbitrary SQL code and gain sensitive information via (1) content parameter to content.php,… Affected: 0.615; 0.615a |
| CVE-2004-2039 | – | May 29 | e107 0.615 allows remote attackers to obtain sensitive information via a direct request to (1) alt_news.php, (2) backend_menu.php, (3) clock_menu.php, (4) counter_menu.php, (5)… Affected: 0.6_15; 0.6_15a |
| CVE-2004-2028 | – | May 21 | Cross-site scripting (XSS) vulnerability in stats.php in e107 allows remote attackers to inject arbitrary web script or HTML via the referer parameter to log.php Affected: 0.6_10; 0.6_11; 0.6_12; 0.6_13; 0.6_14; 0.6_15; +5 more |
| CVE-2004-2031 | – | May 21 | Cross-site scripting (XSS) vulnerability in user.php in e107 allows remote attackers to inject arbitrary web script or HTML via the (1) URL, (2) MSN, or (3) AIM fields Affected: 0.545; 0.554; 0.555_beta; 0.603; 0.610; 0.611; +5 more |
| CVE-2003-1191 | – | Oct 29 | chatbox.php in e107 0.554 and 0.603 allows remote attackers to cause a denial of service (pages fail to load) via HTML in the Name field, which prevents the main.php form from… Affected: 0.545; 0.603 |