CVE-2010-0996

Unrestricted file upload vulnerability in e107 before 0.7.20 allows remote authenticated users to execute arbitrary code by uploading a .php.filetypesphp file. NOTE: the vendor disputes the significance of this issue, noting that "an odd set of preferences and a missing file" are required...

CVE-2010-0996

Unrestricted file upload vulnerability in e107 before 0.7.20 allows remote authenticated users to execute arbitrary code by uploading a .php.filetypesphp file. NOTE: the vendor disputes the significance of this issue, noting that "an odd set of preferences and a missing file" are required...

CVE-2010-0997

Cross-site scripting XSS vulnerability in 107plugins/content/contentmanager.php in the Content Management plugin in e107 before 0.7.20, when the personal content manager is enabled, allows user-assisted remote authenticated users to inject arbitrary web script or HTML via the contentheading...

CVE-2010-0997

The CVE-2010-0997 entry covers an XSS vulnerability in the e107 Content Management plugin, specifically in 107_plugins/content/content_manager.php when the Personal Content Manager is enabled. The underlying issue is insufficient sanitization of the content_heading parameter, allowing user-assist...

CVE-2010-0996

Summary of CVE-2010-0996 (e107) : Affected software is e107 prior to version 0.7.20. The issue is an unrestricted file upload vulnerability that can allow remote authenticated users to execute arbitrary PHP code by uploading a ".php.filetypesphp" file. The vendor disputes the severity, stating th...

CVE-2010-0996: Undefined Security Weakness

Unrestricted file upload vulnerability in e107 before 0.7.20 allows remote authenticated users to execute arbitrary code by uploading a .php.filetypesphp file. NOTE: the vendor disputes the significance of this issue, noting that "an odd set of preferences and a missing file" are required...

e107 0.7.19 Cross Site Request Forgery

Vulnerability ID: HTB22344 Reference: http://www.htbridge.ch/advisory/xsrfcsrfine107.html Product: e107 Website System Vendor: e107 Vulnerable Version: 0.7.19 and Probably Prior Versions Vendor Notification: 05 April 2010 Vulnerability Type: CSRF Cross-Site Request Forgery Status: Not Fixed, Vend...

CVE-2010-0997: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in 107plugins/content/contentmanager.php in the Content Management plugin in e107 before 0.7.20, when the personal content manager is enabled, allows user-assisted remote authenticated users to inject arbitrary web script or HTML via the contentheading...

Secunia Research: e107 Avatar/Photograph Image File Upload Vulnerability

====================================================================== Secunia Research 19/04/2010 - e107 Avatar/Photograph Image File Upload Vulnerability - ====================================================================== Table of Contents Affected...

e107 -- code execution and XSS vulnerabilities

Secunia Research reported two vulnerabilities in e107: The first problem affects installations that have the Content Manager plugin enabled. This plugin does not sanitize the "contentheading" parameter correctly and is therefore vulnerable to a cross site scripting attack. The second vulnerabilit...

Cross-site request forgery (CSRF) in e107

High-Tech Bridge SA Security Research Lab has discovered two CSRF vulnerabilities in e107 which could allow a remote attacker to execute arbitrary SQL commands in applications database and gain complete control over the application. 1 Cross-site request forgery in e107 1.1 The vulnerability is...

e107 Plugin Blog (macgurublog.php) Remote SQL Injection Vulnerability

Exploit for php platform in category web applications ===================================================================== e107 Plugin Blog macgurublog.php Remote SQL Injection Vulnerability ===================================================================== @Title: e107 Plugin Blog...

e107 submitnews.php XSS

The version of e107 on the remote host is affected by a cross-site scripting vulnerability because the 'submitnews.php' script fails to properly sanitize user-supplied input. A remote attacker can exploit this by tricking a user into making a specially crafted POST request. There are reportedly...

CVE-2009-4083

Multiple cross-site scripting XSS vulnerabilities in e107 0.7.16 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in 1 submitnews.php, 2 usersettings.php; and 3 newpost.php, 4 banlist.php, 5 banner.php, 6 cpage.php, 7 download.php, 8...

CVE-2009-4084

SQL injection vulnerability in the search feature in e107 0.7.16 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in e107 0.7.16 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in 1 submitnews.php, 2 usersettings.php; and 3 newpost.php, 4 banlist.php, 5 banner.php, 6 cpage.php, 7 download.php, 8...

Sql injection

SQL injection vulnerability in the search feature in e107 0.7.16 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

php content management system e107 multiple cross-site scripting and SQL injection vulnerabilities-vulnerability warning-the black bar safety net

Affected version: e107 website system 0.7.16 vulnerability description: e107 is a php written content management system. e107 the following module did not sufficiently filter user-submitted variable: - submitnews.php - usersettings.php. - e107admin/newpost.php. - e107admin/banlist.php. -...

CVE-2009-4084

SQL injection vulnerability in the search feature in e107 0.7.16 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2009-4084

CVE-2009-4084 concerns SQL injection in the search feature of e107 versions 0.7.16 and earlier. The vulnerability allows remote attackers to execute arbitrary SQL commands via unspecified vectors, with a potentially partial confidentiality, integrity, and availability impact (per the NVD entry). ...