CVE-2018-17081: Cross-Site Request Forgery (CSRF)

e107 2.1.9 allows CSRF via e107admin/wmessage.php?mode=&action=inline&ajaxused=1&id= for changing the title of an arbitrary page...

PT-2018-13884

Name of the Vulnerable Software and Affected Versions e107 version 2.1.9 Description The issue allows for a CSRF attack, which can be used to change the title of an arbitrary page. This is possible through the "e107 admin/wmessage.php" endpoint with specific parameters set, such as mode, action s...

e107 File Upload Vulnerability

e107 is an open source, free and PHP and MySQL based Content Management System CMS developed by the e107 team. The system supports a variety of plug-ins and appearance of the theme , can be used as a personal blog , discussion community , archive repository and so on. A security vulnerability...

e107 < 2.1.9 Multiple Vulnerabilities

e107 is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:e107:e107"; if description...

CVE-2018-16389

e107admin/banlist.php in e107 2.1.8 allows SQL injection via the oldip parameter...

CVE-2018-16389

e107admin/banlist.php in e107 2.1.8 allows SQL injection via the oldip parameter...

CVE-2018-16388

e107web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content type...

CVE-2018-16388

e107web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content type...

Sql injection

e107admin/banlist.php in e107 2.1.8 allows SQL injection via the oldip parameter...

Design/Logic Flaw

e107web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content type...

CVE-2018-16388

e107web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content type...

CVE-2018-16388

e107web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content type...

CVE-2018-16389

e107admin/banlist.php in e107 2.1.8 allows SQL injection via the oldip parameter...

CVE-2018-16389

e107admin/banlist.php in e107 2.1.8 allows SQL injection via the oldip parameter...

CVE-2018-16389

CVE-2018-16389 affects e107 2.1.8 where e107_admin/banlist.php accepts the old_ip parameter, enabling SQL injection. This is documented across multiple sources (NVD entry: SQL injection via old_ip; CNVD/CPE notes also describe the same vulnerability). No exploitation details are provided in the c...

CVE-2018-16388

CVE-2018-16388 affects e107 CMS, version 2.1.8. The issue is in e107_web/js/plupload/upload.php : a remote attacker can upload a file named with a .php extension but with an image/jpeg content type, leading to arbitrary PHP code execution . The CVSS metrics in the documents indicate a high impact...

PT-2018-13540

Name of the Vulnerable Software and Affected Versions e107 version 2.1.8 Description The issue allows SQL injection via the old ip parameter in the e107 admin/banlist.php file. Recommendations For version 2.1.8, avoid using the old ip parameter in the affected API endpoint until the issue is...

CVE-2018-16389: Improper Neutralization of Special Elements used in an SQL Command

e107admin/banlist.php in e107 2.1.8 allows SQL injection via the oldip parameter...

PT-2018-13539

Name of the Vulnerable Software and Affected Versions e107 version 2.1.8 Description The issue allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the content type set to 'image/jpeg'. This is possible due to a flaw in the 'e107 web/js/plupload/upload.php' file...

CVE-2018-16388: Unrestricted Upload of File with Dangerous Type

e107web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content type...