976 matches found
e107 <= 2.1.9 CSRF Vulnerability
e107 allows CSRF for changing the title of an arbitrary page. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:e107:e107"; if...
CVE-2018-17081
e107 2.1.9 allows CSRF via e107admin/wmessage.php?mode=&action=inline&ajaxused=1&id= for changing the title of an arbitrary page...
CVE-2018-17081
e107 2.1.9 allows CSRF via e107admin/wmessage.php?mode=&action=inline&ajaxused=1&id= for changing the title of an arbitrary page...
Cross site request forgery (csrf)
e107 2.1.9 allows CSRF via e107admin/wmessage.php?mode=&action=inline&ajaxused=1&id= for changing the title of an arbitrary page...
CVE-2018-17081
e107 2.1.9 allows CSRF via e107admin/wmessage.php?mode=&action=inline&ajaxused=1&id= for changing the title of an arbitrary page...
CVE-2018-17081
The entries confirm a CSRF vulnerability in e107 2.1.9 that allows an attacker to change the title of an arbitrary page via the request to e107_admin/wmessage.php?mode=&action=inline&ajax_used=1&id=. The issue is triggered by an inline CSRF path in the CMS’s admin interface, potentially enabling ...
e107 File Upload Vulnerability
e107 is an open source, free and PHP and MySQL based Content Management System CMS developed by the e107 team. The system supports a variety of plug-ins and appearance of the theme , can be used as a personal blog , discussion community , archive repository and so on. A security vulnerability...
e107 < 2.1.9 Multiple Vulnerabilities
e107 is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:e107:e107"; if description...
CVE-2018-16388
e107web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content type...
CVE-2018-16389
e107admin/banlist.php in e107 2.1.8 allows SQL injection via the oldip parameter...
CVE-2018-16388
e107web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content type...
CVE-2018-16389
e107admin/banlist.php in e107 2.1.8 allows SQL injection via the oldip parameter...
Design/Logic Flaw
e107web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content type...
Sql injection
e107admin/banlist.php in e107 2.1.8 allows SQL injection via the oldip parameter...
CVE-2018-16388
e107web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content type...
CVE-2018-16389
e107admin/banlist.php in e107 2.1.8 allows SQL injection via the oldip parameter...
CVE-2018-16389
CVE-2018-16389 affects e107 2.1.8 where e107_admin/banlist.php accepts the old_ip parameter, enabling SQL injection. This is documented across multiple sources (NVD entry: SQL injection via old_ip; CNVD/CPE notes also describe the same vulnerability). No exploitation details are provided in the c...
CVE-2018-16388
CVE-2018-16388 affects e107 CMS, version 2.1.8. The issue is in e107_web/js/plupload/upload.php : a remote attacker can upload a file named with a .php extension but with an image/jpeg content type, leading to arbitrary PHP code execution . The CVSS metrics in the documents indicate a high impact...
e107 <= 2.1.8 Multiple Vulnerabilities
E107 is prone to multiple vulnerabilities. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribu...