17 matches found
CVE-2025-11941: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was detected in e107 CMS up to 2.3.3. This impacts an unknown function of the file /e107admin/image.php?mode=main&action=avatar of the component Avatar Handler. Performing manipulation of the argument multiaction results in path traversal. It is possible to initiate the attack...
EUVD-2018-9176
Malware in sbrugna...
CVE-2012-6434
Multiple cross-site request forgery CSRF vulnerabilities in e107admin/download.php in e107 1.0.2 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the 1 downloadurl, 2 downloadurlextended, 3 downloadauthoremail, 4...
CVE-2018-17423
An issue was discovered in e107 v2.1.9. There is a XSS attack on e107admin/comment.php...
CVE-2018-17423
An issue was discovered in e107 v2.1.9. There is a XSS attack on e107admin/comment.php...
CVE-2018-17423: Improper Neutralization of Input During Web Page Generation
An issue was discovered in e107 v2.1.9. There is a XSS attack on e107admin/comment.php...
CVE-2018-16389
e107admin/banlist.php in e107 2.1.8 allows SQL injection via the oldip parameter...
CVE-2018-16389: Improper Neutralization of Special Elements used in an SQL Command
e107admin/banlist.php in e107 2.1.8 allows SQL injection via the oldip parameter...
CVE-2016-10378
e107 2.1.1 allows SQL injection by remote authenticated administrators via the pagelist parameter to e107admin/menus.php, related to the menuSaveVisibility function...
CVE-2014-9459: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in the AdminObserver function in e107admin/users.php in e107 2.0 alpha2 allows remote attackers to hijack the authentication of administrators for requests that add users to the administrator group via the id parameter in an admin action...
CVE-2014-4734
Cross-site scripting XSS vulnerability in e107admin/db.php in e107 2.0 alpha2 and earlier allows remote attackers to inject arbitrary web script or HTML via the type parameter...
CVE-2012-6434: Cross-Site Request Forgery (CSRF)
Multiple cross-site request forgery CSRF vulnerabilities in e107admin/download.php in e107 1.0.2 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the 1 downloadurl, 2 downloadurlextended, 3 downloadauthoremail, 4...
CVE-2011-4947: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in e107admin/usersextended.php in e107 before 0.7.26 allows remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting XSS sequences via the userinclude parameter...
CVE-2010-5084: Cross-Site Request Forgery (CSRF)
The cross-site request forgery CSRF protection mechanism in e107 before 0.7.23 uses a predictable random token based on the creation date of the administrator account, which allows remote attackers to hijack the authentication of administrators for requests that add new users via...
CVE-2011-4920
Multiple cross-site scripting XSS vulnerabilities in e107 0.7.26, and other versions before 1.0.0, allow remote attackers to inject arbitrary web script or HTML via the URL to 1 e107images/thumb.php or 2 rate.php, 3 resendname parameter to e107admin/users.php, and 4 link BBCode in user signatures...
CVE-2011-4920: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in e107 0.7.26, and other versions before 1.0.0, allow remote attackers to inject arbitrary web script or HTML via the URL to 1 e107images/thumb.php or 2 rate.php, 3 resendname parameter to e107admin/users.php, and 4 link BBCode in user signatures...
CVE-2009-4083: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in e107 0.7.16 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in 1 submitnews.php, 2 usersettings.php; and 3 newpost.php, 4 banlist.php, 5 banner.php, 6 cpage.php, 7 download.php, 8...