CVE-2026-72599 | Critical | 9.8 | 2026-08-11 | An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The paramete… |
CVE-2021-47937 | High | 8.8 | 2026-05-10 | e107 CMS 2.3.0 contains a remote code execution vulnerability that allows authenticated users with theme installation permissions to execute arbitrary commands… |
CVE-2022-50939 | High | 7.2 | 2026-01-13 | e107 CMS version 3.2.1 contains a critical file upload vulnerability that allows authenticated administrators to override arbitrary server files through path t… |
CVE-2022-50916 | High | 7.2 | 2026-01-13 | e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrators to override server files through the Media Manager import… |
CVE-2022-50907 | High | 7.2 | 2026-01-13 | e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrative users to bypass upload restrictions and execute PHP files… |
CVE-2022-50906 | Medium | 4.8 | 2026-01-13 | e107 CMS 3.2.1 contains an upload restriction bypass vulnerability that allows authenticated administrators to upload malicious SVG files through the media man… |
CVE-2022-50905 | Critical | 9.8 | 2026-01-13 | e107 CMS version 3.2.1 contains multiple vulnerabilities that allow cross-site scripting (XSS) attacks. The first vulnerability is a reflected XSS that occurs… |
CVE-2025-11941 | Medium | 5.4 | 2025-10-19 | A vulnerability was detected in e107 CMS up to 2.3.3. This impacts an unknown function of the file /e107_admin/image.php?mode=main&action=avatar of the compone… |
CVE-2025-61505 | Medium | 6.5 | 2025-10-10 | e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the `install.php` script. The script processes user-controlled input in the `previous_steps`… |
CVE-2023-43874 | Medium | 5.4 | 2023-09-28 | Multiple Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script to the Copyright a… |
CVE-2023-43873 | Medium | 5.4 | 2023-09-28 | A Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script to the Name filed in the… |
CVE-2023-36121 | Medium | 5.4 | 2023-08-02 | Cross Site Scripting vulnerability in e107 v.2.3.2 allows a remote attacker to execute arbitrary code via the description function in the SEO project. |
CVE-2021-27885 | High | 8.8 | 2021-03-02 | usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism. |
CVE-2018-11734 | Medium | 6.1 | 2019-07-10 | In e107 v2.1.7, output without filtering results in XSS. |
CVE-2018-17423 | Medium | 4.8 | 2019-06-19 | An issue was discovered in e107 v2.1.9. There is a XSS attack on e107_admin/comment.php. |
CVE-2016-10753 | High | 8.8 | 2019-05-24 | e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC. |
CVE-2018-17081 | Medium | 4.3 | 2018-09-26 | e107 2.1.9 allows CSRF via e107_admin/wmessage.php?mode=&action=inline&ajax_used=1&id= for changing the title of an arbitrary page. |
CVE-2018-16389 | Medium | 6.5 | 2018-09-12 | e107_admin/banlist.php in e107 2.1.8 allows SQL injection via the old_ip parameter. |
CVE-2018-16388 | High | 7.2 | 2018-09-12 | e107_web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content ty… |
CVE-2018-16381 | Medium | 6.1 | 2018-09-05 | e107 2.1.8 has XSS via the e107_admin/users.php?mode=main&action=list user_loginname parameter. |
CVE-2018-15901 | High | 8.8 | 2018-08-28 | e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including administrators. |
CVE-2018-11127 | Medium | 6.5 | 2018-05-15 | e107 2.1.7 has CSRF resulting in arbitrary user deletion. |
CVE-2016-10378 | High | 7.2 | 2017-05-29 | e107 2.1.1 allows SQL injection by remote authenticated administrators via the pagelist parameter to e107_admin/menus.php, related to the menuSaveVisibility fu… |
CVE-2017-8098 | Medium | 6.5 | 2017-04-24 | e107 2.1.4 is vulnerable to cross-site request forgery in plugin-installing, meta-changing, and settings-changing. A malicious web page can use forged requests… |
CVE-2015-1057 | | | 2015-01-16 | Cross-site scripting (XSS) vulnerability in usersettings.php in e107 2.0.0 allows remote attackers to inject arbitrary web script or HTML via the "Real Name" v… |
CVE-2015-1041 | | | 2015-01-15 | Cross-site scripting (XSS) vulnerability in e107_admin/filemanager.php in e107 1.0.4 allows remote attackers to inject arbitrary web script or HTML via the e10… |
CVE-2014-9459 | | | 2015-01-02 | Cross-site request forgery (CSRF) vulnerability in the AdminObserver function in e107_admin/users.php in e107 2.0 alpha2 allows remote attackers to hijack the… |
CVE-2014-4734 | | | 2014-07-21 | Cross-site scripting (XSS) vulnerability in e107_admin/db.php in e107 2.0 alpha2 and earlier allows remote attackers to inject arbitrary web script or HTML via… |
CVE-2013-7305 | | | 2014-01-22 | fpw.php in e107 through 1.0.4 does not check the user_ban field, which makes it easier for remote attackers to reset passwords by sending a pwsubmit request an… |
CVE-2013-2750 | | | 2014-01-22 | Cross-site scripting (XSS) vulnerability in e107_plugins/content/handlers/content_preset.php in e107 before 1.0.3 allows remote attackers to inject arbitrary w… |
CVE-2012-6434 | | | 2013-01-03 | Multiple cross-site request forgery (CSRF) vulnerabilities in e107_admin/download.php in e107 1.0.2 allow remote attackers to hijack the authentication of admi… |
CVE-2012-6433 | | | 2013-01-03 | Cross-site request forgery (CSRF) vulnerability in e107_admin/newspost.php in e107 1.0.1 allows remote attackers to hijack the authentication of administrators… |
CVE-2011-5186 | | | 2012-09-20 | Cross-site scripting (XSS) vulnerability in jbshop.php in the jbShop plugin for e107 7 allows remote attackers to inject arbitrary web script or HTML via the i… |
CVE-2011-4947 | | | 2012-08-31 | Cross-site request forgery (CSRF) vulnerability in e107_admin/users_extended.php in e107 before 0.7.26 allows remote attackers to hijack the authentication of… |
CVE-2011-4946 | | | 2012-08-31 | SQL injection vulnerability in e107_admin/users_extended.php in e107 before 0.7.26 allows remote attackers to execute arbitrary SQL commands via the user_field… |
CVE-2012-3843 | | | 2012-07-03 | Cross-site scripting (XSS) vulnerability in the registration page in e107, probably 1.0.1, allows remote attackers to inject arbitrary web script or HTML via u… |
CVE-2010-5084 | | | 2012-02-14 | The cross-site request forgery (CSRF) protection mechanism in e107 before 0.7.23 uses a predictable random token based on the creation date of the administrato… |
CVE-2011-4921 | | | 2012-01-04 | SQL injection vulnerability in usersettings.php in e107 0.7.26, and possibly other versions before 1.0.0, allows remote attackers to execute arbitrary SQL comm… |
CVE-2011-4920 | | | 2012-01-04 | Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.26, and other versions before 1.0.0, allow remote attackers to inject arbitrary web script or H… |
CVE-2011-1513 | | | 2011-11-04 | Static code injection vulnerability in install_.php in e107 CMS 0.7.24 and probably earlier versions, when the installation script is not removed, allows remot… |
CVE-2011-3731 | | | 2011-09-23 | e107 0.7.24 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error messag… |
CVE-2011-0457 | | | 2011-03-15 | Cross-site scripting (XSS) vulnerability in e107 0.7.22 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2010-4757 | | | 2011-03-15 | Cross-site scripting (XSS) vulnerability in submitnews.php in e107 before 0.7.23 allows remote attackers to inject arbitrary web script or HTML via the submitn… |
CVE-2010-2099 | | | 2010-05-27 | bbcode/php.bb in e107 0.7.20 and earlier does not perform access control checks for all inputs that could contain the php bbcode tag, which allows remote attac… |
CVE-2010-2098 | | | 2010-05-27 | Incomplete blacklist vulnerability in usersettings.php in e107 0.7.20 and earlier allows remote attackers to conduct SQL injection attacks via the loginname pa… |
CVE-2010-0997 | | | 2010-04-20 | Cross-site scripting (XSS) vulnerability in 107_plugins/content/content_manager.php in the Content Management plugin in e107 before 0.7.20, when the personal c… |
CVE-2010-0996 | | | 2010-04-20 | Unrestricted file upload vulnerability in e107 before 0.7.20 allows remote authenticated users to execute arbitrary code by uploading a .php.filetypesphp file… |
CVE-2009-4084 | | | 2009-11-29 | SQL injection vulnerability in the search feature in e107 0.7.16 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors. |
CVE-2009-4083 | | | 2009-11-29 | Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.16 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified ve… |
CVE-2009-3444 | | | 2009-09-28 | Cross-site scripting (XSS) vulnerability in email.php in e107 0.7.16 and earlier allows remote attackers to inject arbitrary web script or HTML via the HTTP Re… |
CVE-2009-1409 | | | 2009-04-24 | SQL injection vulnerability in usersettings.php in e107 0.7.15 and earlier, when "Extended User Fields" is enabled and magic_quotes_gpc is disabled, allows rem… |
CVE-2008-6466 | | | 2009-03-13 | SQL injection vulnerability in image_gallery.php in the Akira Powered Image Gallery (image_gallery) plugin 0.9.6.2 for e107 allows remote attackers to execute… |
CVE-2008-6438 | | | 2009-03-06 | SQL injection vulnerability in macgurublog_menu/macgurublog.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows remote attackers to execute arbitrary SQL… |
CVE-2008-6208 | | | 2009-02-20 | Cross-site scripting (XSS) vulnerability in submitnews.php in e107 CMS 0.7.11 allows remote attackers to inject arbitrary web script or HTML via the (1) author… |
CVE-2008-6114 | | | 2009-02-11 | SQL injection vulnerability in product_details.php in the Mytipper Zogo-shop 1.15.4 plugin for e107 allows remote attackers to execute arbitrary SQL commands v… |
CVE-2008-6069 | | | 2009-02-10 | SQL injection vulnerability in e107chat.php in the eChat plugin 4.2 for e107, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary S… |
CVE-2008-5320 | | | 2008-12-03 | SQL injection vulnerability in usersettings.php in e107 0.7.13 and earlier allows remote authenticated users to execute arbitrary SQL commands via the ue[] par… |
CVE-2008-4906 | | | 2008-11-04 | SQL injection vulnerability in lyrics_song.php in the Lyrics (lyrics_menu) plugin 0.42 for e107 allows remote attackers to execute arbitrary SQL commands via t… |
CVE-2008-4786 | | | 2008-10-29 | SQL injection vulnerability in easyshop.php in the EasyShop plugin for e107 allows remote attackers to execute arbitrary SQL commands via the category_id param… |
CVE-2008-4785 | | | 2008-10-29 | SQL injection vulnerability in newuser.php in the alternate_profiles plugin, possibly 0.2, for e107 allows remote attackers to execute arbitrary SQL commands v… |
CVE-2008-2020 | High | 7.5 | 2008-04-30 | The CAPTCHA implementation as used in (1) Francisco Burzi PHP-Nuke 7.0 and 8.1, (2) my123tkShop e-Commerce-Suite (aka 123tkShop) 0.9.1, (3) phpMyBitTorrent 1.2… |
CVE-2008-1989 | | | 2008-04-27 | PHP remote file inclusion vulnerability in 123flashchat.php in the 123 Flash Chat 6.8.0 module for e107, when register_globals is enabled, allows remote attack… |
CVE-2008-1702 | | | 2008-04-08 | Absolute path traversal vulnerability in dload.php in the my_gallery 2.3 plugin for e107 allows remote attackers to obtain sensitive information via a full pat… |
CVE-2007-3429 | | | 2007-06-27 | Unrestricted file upload vulnerability in signup.php in e107 0.7.8 and earlier, when photograph upload is enabled, allows remote attackers to upload and execut… |
CVE-2006-5786 | | | 2006-11-07 | Directory traversal vulnerability in class2.php in e107 0.7.5 and earlier allows remote attackers to read and execute PHP code in arbitrary files via ".." sequ… |
CVE-2006-4794 | | | 2006-09-14 | Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.5 allow remote attackers to inject arbitrary web script or HTML via the query string (PATH_INFO… |
CVE-2006-4757 | | | 2006-09-13 | Multiple SQL injection vulnerabilities in the admin section in e107 0.7.5 allow remote authenticated administrative users to execute arbitrary SQL commands via… |
CVE-2006-4548 | | | 2006-09-06 | e107 0.75 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash… |
CVE-2006-3259 | | | 2006-06-27 | Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.5 allow remote attackers to inject arbitrary web script or HTML via the (1) ep parameter to sea… |
CVE-2006-2591 | | | 2006-05-25 | Unspecified vulnerability in e107 before 0.7.5 has unknown impact and remote attack vectors related to an "emailing exploit". |
CVE-2006-2590 | | | 2006-05-25 | SQL injection vulnerability in e107 before 0.7.5 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors. |
CVE-2006-2416 | | | 2006-05-16 | SQL injection vulnerability in class2.php in e107 0.7.2 and earlier allows remote attackers to execute arbitrary SQL commands via a cookie as defined in $pref[… |
CVE-2006-0857 | | | 2006-02-23 | Cross-site scripting (XSS) vulnerability in Chatbox Plugin 1.0 in e107 0.7.2 allows remote attackers to inject arbitrary HTML or web script via a Chatbox, as d… |
CVE-2006-0682 | | | 2006-02-15 | Multiple cross-site scripting (XSS) vulnerabilities in bbcodes system in e107 before 0.7.2 allow remote attackers to inject arbitrary web script or HTML via un… |
CVE-2005-4224 | | | 2005-12-14 | Multiple "potential" SQL injection vulnerabilities in e107 0.7 might allow remote attackers to execute arbitrary SQL commands via (1) the email, hideemail, ima… |
CVE-2005-4052 | | | 2005-12-07 | e107 0.6174 allows remote attackers to redirect users to other web sites via the download parameter in rate.php, which is used after a user submits a file down… |
CVE-2005-4051 | | | 2005-12-07 | e107 0.6174 allows remote attackers to vote multiple times for a download via repeated requests to rate.php. |
CVE-2005-3594 | | | 2005-11-16 | game_score.php in e107 allows remote attackers to insert high scores via HTTP POST methods utilizing the $player_name, $player_score, and $game_name variables. |
CVE-2005-3521 | | | 2005-11-06 | SQL injection vulnerability in resetcore.php in e107 0.617 through 0.6173 allows remote attackers to execute arbitrary SQL commands, bypass authentication, and… |
CVE-2005-2805 | | | 2005-09-06 | forum_post.php in e107 0.6 allows remote attackers to post to non-existent forums by modifying the forum number. |
CVE-2005-2559 | | | 2005-08-16 | doping.php in ePing plugin 1.02 and earlier for e107 portal allows remote attackers to execute arbitrary code or overwrite files via (1) shell metacharacters i… |
CVE-2005-2327 | | | 2005-07-20 | Cross-site scripting (XSS) vulnerability in e107 0.617 and earlier allows remote attackers to inject arbitrary web script or HTML via nested [url] BBCode tags. |
CVE-2005-1949 | | | 2005-06-16 | The eping_validaddr function in functions.php for the ePing plugin for e107 portal allows remote attackers to execute arbitrary commands via shell metacharacte… |
CVE-2005-1966 | | | 2005-06-10 | The eTrace_validaddr function in eTrace plugin for e107 portal allows remote attackers to execute arbitrary commands via shell metacharacters after a valid arg… |
CVE-2004-2262 | | | 2004-12-31 | ImageManager in e107 before 0.617 does not properly check the types of uploaded files, which allows remote attackers to execute arbitrary code by uploading a P… |
CVE-2004-2261 | | | 2004-12-31 | Cross-site scripting (XSS) vulnerability in e107 allows remote attackers to inject arbitrary script or HTML via the "login name/author" field in the (1) news s… |
CVE-2004-2042 | | | 2004-05-29 | Multiple SQL injection vulnerabilities in e107 0.615 allow remote attackers to inject arbitrary SQL code and gain sensitive information via (1) content paramet… |
CVE-2004-2041 | | | 2004-05-29 | PHP remote file inclusion vulnerability in secure_img_render.php in e107 0.615 allows remote attackers to execute arbitrary PHP code by modifying the p paramet… |
CVE-2004-2040 | | | 2004-05-29 | Multiple cross-site scripting (XSS) vulnerabilities in e107 0.615 allow remote attackers to inject arbitrary web script or HTML via the (1) LAN_407 parameter t… |
CVE-2004-2039 | | | 2004-05-29 | e107 0.615 allows remote attackers to obtain sensitive information via a direct request to (1) alt_news.php, (2) backend_menu.php, (3) clock_menu.php, (4) coun… |
CVE-2004-2031 | | | 2004-05-21 | Cross-site scripting (XSS) vulnerability in user.php in e107 allows remote attackers to inject arbitrary web script or HTML via the (1) URL, (2) MSN, or (3) AI… |
CVE-2004-2028 | | | 2004-05-21 | Cross-site scripting (XSS) vulnerability in stats.php in e107 allows remote attackers to inject arbitrary web script or HTML via the referer parameter to log.p… |
CVE-2003-1191 | | | 2003-10-29 | chatbox.php in e107 0.554 and 0.603 allows remote attackers to cause a denial of service (pages fail to load) via HTML in the Name field, which prevents the ma… |