EUVD-2026-51123

e107 prior to version 2.3.8 contains a code execution vulnerability in the earray deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the userprefs column. The earray::unserialize function in...

CVE-2026-57859

Summary of CVE-2026-57859 : In e107 prior to version 2.3.8, a code execution vulnerability exists in the e_array deserialization handler. The e_array::unserialize() function only checks for the prefix 'array' before passing the stored value to eval(), allowing an attacker with out-of-band databas...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in DotClear 1.2.6 allow remote attackers to perform actions as arbitrary users via the 1 toolurl parameter to ecrire/tools.php and multiple fields on the 2 blogconf, 3 blogroll, 4 ecrire/redacteur.php, and 5 ecrire/userprefs.php pages...