XSS in E107
CVE-2010-0997
Cross-site scripting (XSS) vulnerability in 107_plugins/content/content_manager.php in the Content Management plugin in e107 before 0.7.20, when the personal content manager is enabled, allows user-assisted remote authenticated users to inject arbitrary web script or HTML via the content_heading parameter.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.010 (60.6th percentile) — read the EPSS interpretation.
Affected products
- E107 — versions 0.7.14, 0.7.1, 0.7.13
- N/a — versions n/a
Weakness classification (CWE)
References
- PSIRT-CNA@flexerasoftware.com (x_refsource_CONFIRM, Patch)
- PSIRT-CNA@flexerasoftware.com (x_refsource_MISC)
- PSIRT-CNA@flexerasoftware.com (x_refsource_SECUNIA, third-party-advisory, Vendor Advisory)
- PSIRT-CNA@flexerasoftware.com (x_refsource_MISC, Vendor Advisory)
- PSIRT-CNA@flexerasoftware.com (mailing-list, x_refsource_BUGTRAQ)
- PSIRT-CNA@flexerasoftware.com (vdb-entry, x_refsource_BID)
- PSIRT-CNA@flexerasoftware.com (vdb-entry, x_refsource_VUPEN, Vendor Advisory)
- PSIRT-CNA@flexerasoftware.com (vdb-entry, x_refsource_XF)