E1
Vendor
e107inc
9
CVEs
0
On KEV
3
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-114407 | E1 e107 e107inc | 6.1 | Oct 21 | e107 CMS before 2.3.13 Reflected XSS via search.php author Parameter |
| CVE-2026-55573 | E1 e107 e107inc | 9.8 | Oct 14 | e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain |
| CVE-2026-55572 | E1 e107 e107inc | 10.0 | Oct 14 | e107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login username |
| CVE-2026-57859 | E1 e107 e107inc | 7.5 | Jul 30 | e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize() |
| CVE-2026-48997 | E1 e107 e107inc | 7.1 | Jun 17 | e107: Command Injection via shell expansion in ImageMagick resize destination path |
| CVE-2026-46620 | E1 e107 e107inc | 6.5 | May 26 | e107: CSRF in comment.php moderation endpoints via token-optional validation in session_handler::check() |
| CVE-2026-43935 | E1 e107 e107inc | 8.1 | May 26 | e107: Host Header Injection in e107 password reset enables phishing |
| CVE-2026-43934 | E1 e107 e107inc | 6.5 | May 26 | e107: Broken Access Control in e107 comment edit allows cross-user comment modification |
| CVE-2026-43936 | E1 e107 e107inc | 4.3 | May 26 | e107: Server-Side Request Forgery (SSRF) in the remote file fetcher |