CVE-2011-4921

SQL injection vulnerability in usersettings.php in e107 0.7.26, and possibly other versions before 1.0.0, allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2011-4920

Multiple cross-site scripting XSS vulnerabilities in e107 0.7.26, and other versions before 1.0.0, allow remote attackers to inject arbitrary web script or HTML via the URL to 1 e107images/thumb.php or 2 rate.php, 3 resendname parameter to e107admin/users.php, and 4 link BBCode in user signatures...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in e107 0.7.26, and other versions before 1.0.0, allow remote attackers to inject arbitrary web script or HTML via the URL to 1 e107images/thumb.php or 2 rate.php, 3 resendname parameter to e107admin/users.php, and 4 link BBCode in user signatures...

Sql injection

SQL injection vulnerability in usersettings.php in e107 0.7.26, and possibly other versions before 1.0.0, allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2011-4921

SQL injection vulnerability in usersettings.php in e107 0.7.26, and possibly other versions before 1.0.0, allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2011-4920

CVE-2011-4920 describes multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.26 and other versions before 1.0.0. The issues allow remote attackers to inject arbitrary web script or HTML via specific URLs/components: (1) e107_images/thumb.php, (2) rate.php, (3) the resend_name parameter...

CVE-2011-4921

The CVE-2011-4921 entry describes a SQL injection in e107:9 usersettings.php affecting e107 0.7.26 and possibly earlier versions before 1.0.0. The flaw allows remote attackers to execute arbitrary SQL commands via the username parameter. Connected sources corroborate the vulnerability but do not ...

CVE-2011-4920

Multiple cross-site scripting XSS vulnerabilities in e107 0.7.26, and other versions before 1.0.0, allow remote attackers to inject arbitrary web script or HTML via the URL to 1 e107images/thumb.php or 2 rate.php, 3 resendname parameter to e107admin/users.php, and 4 link BBCode in user signatures...

PT-2012-1997

Name of the Vulnerable Software and Affected Versions e107 versions 0.7.26 through 0.9.x and other versions prior to 1.0.0 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the URL to "e107 images/thumb.php" or "rate.php", the resend na...

PT-2012-1998

Name of the Vulnerable Software and Affected Versions e107 versions 0.7.26 through 0.9.x and possibly other versions prior to 1.0.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the username parameter in the usersettings.php file...

CVE-2011-4920: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in e107 0.7.26, and other versions before 1.0.0, allow remote attackers to inject arbitrary web script or HTML via the URL to 1 e107images/thumb.php or 2 rate.php, 3 resendname parameter to e107admin/users.php, and 4 link BBCode in user signatures...

CVE-2011-4921: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in usersettings.php in e107 0.7.26, and possibly other versions before 1.0.0, allows remote attackers to execute arbitrary SQL commands via the username parameter...

CVE-2011-1513

Static code injection vulnerability in install.php in e107 CMS 0.7.24 and probably earlier versions, when the installation script is not removed, allows remote attackers to inject arbitrary PHP code into e107config.php via a crafted MySQL server name...

Code injection

Static code injection vulnerability in install.php in e107 CMS 0.7.24 and probably earlier versions, when the installation script is not removed, allows remote attackers to inject arbitrary PHP code into e107config.php via a crafted MySQL server name...

CVE-2011-1513

Static code injection vulnerability in install.php in e107 CMS 0.7.24 and probably earlier versions, when the installation script is not removed, allows remote attackers to inject arbitrary PHP code into e107config.php via a crafted MySQL server name...

CVE-2011-1513

The CVE-2011-1513 entry concerns e107 CMS prior to 0.7.24 where the installation script is not removed, enabling a remote attacker to inject PHP via a crafted MySQL server name and overwrite e107_config.php. Core Security’s advisory CORE-2011-0810 documents OS command injection with code executio...

CVE-2011-1513: Improper Neutralization of Special Elements used in an OS Command

Static code injection vulnerability in install.php in e107 CMS 0.7.24 and probably earlier versions, when the installation script is not removed, allows remote attackers to inject arbitrary PHP code into e107config.php via a crafted MySQL server name...

PT-2011-3180

Name of the Vulnerable Software and Affected Versions e107 CMS versions 0.7.24 and earlier Description The issue concerns a static code injection vulnerability. This vulnerability allows remote attackers to inject arbitrary PHP code into e107 config.php via a crafted MySQL server name when the...

jbShop e107 7 CMS Plugin - SQL Injection

jbShop e107 7 CMS Plugin - SQL Injection Exploit Title: jbShop - e107 v7 CMS plugin - SQL Injection vulnerability Author: Robert Cooper adminatwebsiteauditing.org Software Link: http://sourceforge.net/projects/jbshop/ Tested on: Linux/Windows 7 Vulnerable Parameter: itemid= PoC:...

jbShop SQL Injection

Exploit Title: jbShop - e107 v7 CMS plugin - SQL Injection vulnerability Author: Robert Cooper adminatwebsiteauditing.org Software Link: http://sourceforge.net/projects/jbshop/ Tested on: Linux/Windows 7 Vulnerable Parameter: itemid= PoC:...