e107 query Cross Site Scripting Vulnerability

e107 is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:e107:e107";...

CVE-2013-7305

fpw.php in e107 through 1.0.4 does not check the userban field, which makes it easier for remote attackers to reset passwords by sending a pwsubmit request and leveraging access to the e-mail account of a banned user...

CVE-2013-2750

Cross-site scripting XSS vulnerability in e107plugins/content/handlers/contentpreset.php in e107 before 1.0.3 allows remote attackers to inject arbitrary web script or HTML via the query string...

Cross site request forgery (csrf)

fpw.php in e107 through 1.0.4 does not check the userban field, which makes it easier for remote attackers to reset passwords by sending a pwsubmit request and leveraging access to the e-mail account of a banned user...

Cross site scripting

Cross-site scripting XSS vulnerability in e107plugins/content/handlers/contentpreset.php in e107 before 1.0.3 allows remote attackers to inject arbitrary web script or HTML via the query string...

CVE-2013-2750

Cross-site scripting XSS vulnerability in e107plugins/content/handlers/contentpreset.php in e107 before 1.0.3 allows remote attackers to inject arbitrary web script or HTML via the query string...

CVE-2013-2750

CVE-2013-2750 is an XSS in e107, specifically in e107_plugins/content/handlers/content_preset.php, exploitable when user-supplied input in GET parameters is not properly sanitized (notably via %00/%0d%0a sequences). Affected product: e107 prior to 1.0.3. Impact as described: remote attacker can i...

CVE-2013-7305

CVE-2013-7305 affects the e107 CMS (versions up to 1.0.4). The vulnerability lies in fpw.php, which does not check the user_ban field, enabling remote attackers to reset passwords by sending a pwsubmit request and using access to the banned user’s email account. Multiple sources (Red Hat entry an...

PT-2014-2627

Name of the Vulnerable Software and Affected Versions e107 versions prior to 1.0.3 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the query string. This is due to a vulnerability in the content preset.php file within the e107...

CVE-2013-7305: Undefined Security Weakness

fpw.php in e107 through 1.0.4 does not check the userban field, which makes it easier for remote attackers to reset passwords by sending a pwsubmit request and leveraging access to the e-mail account of a banned user...

CVE-2013-2750: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in e107plugins/content/handlers/contentpreset.php in e107 before 1.0.3 allows remote attackers to inject arbitrary web script or HTML via the query string...

PT-2014-3348

Name of the Vulnerable Software and Affected Versions e107 versions through 1.0.4 Description The issue concerns the lack of validation for the user ban field in the fpw.php file. This oversight allows remote attackers to reset passwords by sending a 'pwsubmit' request, provided they have access ...

e107 Advanced Medal System Plugin - SQL Injection

e107 Advanced Medal System Plugin - SQL Injection Exploit Title: Advanced Medal System SQL Injection Google Dork: inurl:advmedsysview.php Date: 6/18/13 Exploit Author: Life Wasted and Caspa Vendor Homepage: http://e107.org/e107plugins/psilo/list.php?mode=plugin&id=699 Software Link:...

e107 Advanced Medal System Plugin - SQL Injection

Exploit Title: Advanced Medal System SQL Injection Google Dork: inurl:advmedsysview.php Date: 6/18/13 Exploit Author: Life Wasted and Caspa Vendor Homepage: http://e107.org/e107plugins/psilo/list.php?mode=plugin&id=699 Software Link: http://e107.org/e107plugins/psilo/psilo.php?download.699 Versio...

e107 content_preset.php URI XSS

The version of e107 installed on the remote host is affected by a cross-site scripting vulnerability because it fails to properly sanitize user input passed in the URI to the 'contentpreset.php' script. An attacker may be able to leverage this to inject arbitrary HTML and script code into a user'...

TC-SA-2013-01: Reflected Cross-Site-Scripting (XSS) vulnerability in e107 CMS v1.0.2

TC-SA-2013-01: Reflected Cross-Site-Scripting XSS vulnerability in e107 CMS v1.0.2 Published: 2013/04/03 Version 1.0 Affected Products: e107 version 1.0.2 others not tested http://www.e107.org References: TC-SA-2013-01 www.tele-consulting.com/advisories/TC-SA-2013-01.txt used for updates...

e107 'content_preset.php'跨站脚本漏洞(CVE-2013-2750)

Bugtraq ID:58841 CVE ID:CVE-2013-2750 e107是一款内容管理系统。 e107没有正确过滤GET参数中"%00"组合"%0d%0a"的字符输入，允许远程攻击者利用漏洞进行跨站脚本攻击，可获得敏感信息或劫持用户会话。 0 e107 v1.0.2 厂商解决方案 e107 v1.0.3已经修复此漏洞，建议用户下载更新： http://e107.org/ http://host/e107plugins/content/handlers/contentpreset.php? %3c%00script%0d%0aalert'reflexted%20XSS'/scr...

e107 CMS 1.0.2 Cross Site Scripting

TC-SA-2013-01: Reflected Cross-Site-Scripting XSS vulnerability in e107 CMS v1.0.2 Published: 2013/04/03 Version 1.0 Affected Products: e107 version 1.0.2 others not tested http://www.e107.org References: TC-SA-2013-01 www.tele-consulting.com/advisories/TC-SA-2013-01.txt used for updates...

e107 - content_preset.php Cross-Site Scripting

e107 - contentpreset.php Cross-Site Scripting source: https://www.securityfocus.com/bid/58841/info e107 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser o...

e107 - 'content_preset.php' Cross-Site Scripting

source: https://www.securityfocus.com/bid/58841/info e107 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the...