Vulnerability in E107

CVE-2013-7305

fpw.php in e107 through 1.0.4 does not check the user_ban field, which makes it easier for remote attackers to reset passwords by sending a pwsubmit request and leveraging access to the e-mail account of a banned user.

EPSS: 0.010 (57.9th percentile) — read the EPSS interpretation.

Affected products

  • E107 — versions 0.7.0, 0.7.1, 0.7.2
  • N/a — versions n/a

Weakness classification (CWE)

References