XSS in E107
CVE-2022-50905
e107 CMS version 3.2.1 contains multiple vulnerabilities that allow cross-site scripting (XSS) attacks. The first vulnerability is a reflected XSS that occurs in the news comment functionality when authenticated users interact with the comment form. An attacker can inject malicious JavaScript code through the URL parameter that gets executed when users click outside the comment field after typing content. The second vulnerability involves an upload restriction bypass for authenticated administrators, allowing them to upload SVG files containing malicious code through the media manager's remote URL upload feature. This results in stored XSS when the uploaded SVG files are accessed. These vulnerabilities were discovered by Hubert Wojciechowski and affect the news.php and image.php components of the CMS.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.007 (50.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 51st percentile — 50.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.007 · change: +0.001
Affected products
Weakness classification (CWE)
References
- www.exploit-db.com/exploits/50910 (Exploit, VDB Entry, Third Party Advisory, exploit)
- e107.org/ (Product, product)
- e107.org/download (Product, product)
- www.vulncheck.com/advisories/e-cms-reflected-xss-via-comment-flow (Third Party Advisory, third-party-advisory)
Frequently asked questions
- What is CVE-2022-50905?
- CVE-2022-50905 is a critical-severity vulnerability in E107, classified under Cross-site Scripting. CVSS score: 9.8/10. Published 2026-01-13.
- How severe is CVE-2022-50905?
- Critical severity. CVSS v3 base score is 9.8 out of 10.