e107_2.1.9_CSRF_POC

e1072.1.9CSRFPOC CVE-2018-17081...

CVE-2025-61505

CVE-2025-61505 – PHP Object Injection in e107 CMS 2.x Reported: September 18, 2025 CVE Assigned: October 9, 2025 Published: February 02, 2026 CVE ID: CVE-2025-61505 Discoverer: Anas Abderrahman Benbarek Summary A PHP Object Injection vulnerability CWE-502: Deserialization of Untrusted Data was...

CVE-2023-43873-e107-CMS-Stored-XSS---Manage

e107 CMS Stored XSS v2.3.2 Author: Sergio Description: Cross Site Scripting XSS vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script to the Name filed in the Manage Menu. Attack Vectors: Scripting A vulnerability in the sanitization of the entry...

CVE-2023-43874-e107-CMS-Stored-XSS---MetaCustomTags

e107 CMS Stored XSS v2.3.2 Author: Sergio Description: Multiple Cross Site Scripting XSS vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script to the Copyright and Author fields in the Meta & Custom Tags Menu. Attack Vectors: Scripting A...

CVE-2026-114407

e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML by manipulating the author GET parameter in search.php, which is parsed with parsestr and concatenated unescaped into a rendered input tag via the form...

CVE-2026-114407 e107 CMS before 2.3.13 Reflected XSS via search.php author Parameter

e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML by manipulating the author GET parameter in search.php, which is parsed with parsestr and concatenated unescaped into a rendered input tag via the form...

CVE-2026-114407 e107 CMS before 2.3.13 Reflected XSS via search.php author Parameter

e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML by manipulating the author GET parameter in search.php, which is parsed with parsestr and concatenated unescaped into a rendered input tag via the form...

EUVD-2026-107215

e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML by manipulating the author GET parameter in search.php, which is parsed with parsestr and concatenated unescaped into a rendered input tag via the form...

CVE-2026-114407 e107 CMS before 2.3.13 Reflected XSS via search.php author Parameter

e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML by manipulating the author GET parameter in search.php, which is parsed with parsestr and concatenated unescaped into a rendered input tag via the form...

CVE-2026-114407

e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML by manipulating the author GET parameter in search.php, which is parsed with parsestr and concatenated unescaped into a rendered input tag via the form...

CVE-2026-114407

The e107 CMS before version 2.3.13 is vulnerable to a reflected cross-site scripting (XSS) flaw. The issue resides in search.php when the author GET parameter is processed using parse_str(). Because the data is concatenated unescaped into a rendered input tag via the form handler's 'other' option...

PT-2026-120555

e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML by manipulating the author GET parameter in search.php, which is parsed with parse str and concatenated unescaped into a rendered input tag via the form...

e107 Content Management System e107 Cross-site Scripting Vulnerability

The e107 Content Management System contains a cross-site scripting vulnerability in versions 2.2.0 through 2.3.13. This vulnerability arises because the author GET parameter in search.php is parsed via parsestr without escaping before being concatenated into the rendered input field...

CVE-2026-55573

e107 is a content management system CMS. Prior to 2.3.7, install.php decodes the attacker-controlled previoussteps POST parameter and passes it to unserialize at file scope and again in the einstall constructor without restricting allowed classes. The installer remains accessible after a normal...

CVE-2026-55572

e107 is a content management system CMS. Prior to 2.3.7, the bundled altauth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107plugins/altauth/otherdbauth.php and e107plugins/altauth/e107dbauth.php. The login methods execute thos...

EUVD-2026-101532

e107 is a content management system CMS. Prior to 2.3.7, install.php decodes the attacker-controlled previoussteps POST parameter and passes it to unserialize at file scope and again in the einstall constructor without restricting allowed classes. The installer remains accessible after a normal...

CVE-2026-55573

The e107 content management system (CMS) versions prior to 2.3.7 is vulnerable to unauthenticated remote code execution (RCE) due to unsafe deserialization. The install.php file processes the attacker-controlled previous_steps POST parameter using unserialize() without restricting allowed classes...

CVE-2026-55573 e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain

e107 is a content management system CMS. Prior to 2.3.7, install.php decodes the attacker-controlled previoussteps POST parameter and passes it to unserialize at file scope and again in the einstall constructor without restricting allowed classes. The installer remains accessible after a normal...

CVE-2026-55573 e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain

e107 is a content management system CMS. Prior to 2.3.7, install.php decodes the attacker-controlled previoussteps POST parameter and passes it to unserialize at file scope and again in the einstall constructor without restricting allowed classes. The installer remains accessible after a normal...

CVE-2026-55573

e107 is a content management system CMS. Prior to 2.3.7, install.php decodes the attacker-controlled previoussteps POST parameter and passes it to unserialize at file scope and again in the einstall constructor without restricting allowed classes. The installer remains accessible after a normal...