CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 2CVE-2021-27885 – e107 CMS 2.3.0 - CSRF
https://notcve.org/view.php?id=CVE-2021-27885
02 Mar 2021 — usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism. El archivo usersettings.php en e107 hasta la versión 2.3.0, carece de cierto mecanismo de protección e_TOKEN e107 CMS version 2.3.0 suffers from a cross site request forgery vulnerability. • https://packetstorm.news/files/id/161651 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 2EXPL: 4CVE-2014-4734 – e107 2.0 alpha2 Cross Site Scripting
https://notcve.org/view.php?id=CVE-2014-4734
16 Jul 2014 — Cross-site scripting (XSS) vulnerability in e107_admin/db.php in e107 2.0 alpha2 and earlier allows remote attackers to inject arbitrary web script or HTML via the type parameter. Vulnerabilidad de XSS en e107_admin/db.php en e107 2.0 alpha2 y anteriores permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro type. e107 version 2.0 alpha2 suffers from a reflective cross site scripting vulnerability. • https://packetstorm.news/files/id/127499 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 27EXPL: 1CVE-2013-2750 – e107 - 'content_preset.php' Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2013-2750
22 Jan 2014 — Cross-site scripting (XSS) vulnerability in e107_plugins/content/handlers/content_preset.php in e107 before 1.0.3 allows remote attackers to inject arbitrary web script or HTML via the query string. Vulnerabilidad de XSS en e107_plugins/content/handlers/content_preset.php de e107 anterior a la versión 1.0.3 permite a atacantes remotos inyectar script Web o HTML arbitrario a través de una cadena de consulta. • https://www.exploit-db.com/exploits/38416 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.1EPSS: 0%CPEs: 29EXPL: 0CVE-2013-7305
https://notcve.org/view.php?id=CVE-2013-7305
22 Jan 2014 — fpw.php in e107 through 1.0.4 does not check the user_ban field, which makes it easier for remote attackers to reset passwords by sending a pwsubmit request and leveraging access to the e-mail account of a banned user. fpw.php en e107 hasta la versión 1.0.4 no comprueba el campo user_ban, lo que hace más fácil para atacantes remotos restablecer contraseñas mediante el envío de una petición pwsubmit y aprovechando el acceso a la cuenta de email de un usuario baneado. • http://sourceforge.net/p/e107/svn/13114 • CWE-255: Credentials Management Errors •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 3CVE-2012-6434 – e107 1.0.2 - SQL Injection (via Cross-Site Request Forgery)
https://notcve.org/view.php?id=CVE-2012-6434
03 Jan 2013 — Multiple cross-site request forgery (CSRF) vulnerabilities in e107_admin/download.php in e107 1.0.2 allow remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks via the (1) download_url, (2) download_url_extended, (3) download_author_email, (4) download_author_website, (5) download_image, (6) download_thumb, (7) download_visible, or (8) download_class parameter. Múltiples vulnerabilidades de fasificación de peticiones en sitios cruzados (CSRF) en e107... • https://www.exploit-db.com/exploits/23829 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 2%CPEs: 66EXPL: 0CVE-2010-0996
https://notcve.org/view.php?id=CVE-2010-0996
20 Apr 2010 — Unrestricted file upload vulnerability in e107 before 0.7.20 allows remote authenticated users to execute arbitrary code by uploading a .php.filetypesphp file. NOTE: the vendor disputes the significance of this issue, noting that "an odd set of preferences and a missing file" are required. Vulnerabilidad de subida de fichero sin restricciones en e107 en versiones anteriores a la v0.7.20. Permite a usuarios remotos autenticados ejecutar comandos de su elección subiendo un fichero .php.filetypesphp. NOTA: el ... • http://e107.org/comment.php?comment.news.864 •
CVSS: 9.8EPSS: 0%CPEs: 68EXPL: 1CVE-2009-1409 – e107 < 0.7.15 - 'extended_user_fields' Blind SQL Injection
https://notcve.org/view.php?id=CVE-2009-1409
24 Apr 2009 — SQL injection vulnerability in usersettings.php in e107 0.7.15 and earlier, when "Extended User Fields" is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the hide parameter, a different vector than CVE-2005-4224 and CVE-2008-5320. Una vulnerabilidad de inyección de SQL en usersettings.php en e107 v0.7.15 y anteriores, cuando la opción "Campos de usuario extendidos" está activado y magic_quotes_gpc está desactivado, permite a atacantes remotos ejecutar... • https://www.exploit-db.com/exploits/8495 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 56EXPL: 2CVE-2008-5320 – e107 < 0.7.13 - 'usersettings.php' Blind SQL Injection
https://notcve.org/view.php?id=CVE-2008-5320
03 Dec 2008 — SQL injection vulnerability in usersettings.php in e107 0.7.13 and earlier allows remote authenticated users to execute arbitrary SQL commands via the ue[] parameter. Vulnerabilidad de inyección SQL en el archivo usersettings.php en e107 0.7.13 y versiones anteriores, permite a los usuarios remotos autentificados ejecutar arbitrariamente comandos SQL a través del parámetro ue[]. • https://www.exploit-db.com/exploits/6791 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 45EXPL: 0CVE-2006-0682
https://notcve.org/view.php?id=CVE-2006-0682
15 Feb 2006 — Multiple cross-site scripting (XSS) vulnerabilities in bbcodes system in e107 before 0.7.2 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors. • http://e107.org/comment.php?comment.news.776 •
CVSS: 6.1EPSS: 0%CPEs: 37EXPL: 2CVE-2005-2327 – e107 0.617 - Cross-Site Scripting Remote Cookie Disclosure
https://notcve.org/view.php?id=CVE-2005-2327
20 Jul 2005 — Cross-site scripting (XSS) vulnerability in e107 0.617 and earlier allows remote attackers to inject arbitrary web script or HTML via nested [url] BBCode tags. Vulnerabilidad de secuencia de comandos en sitios cruzados en e107 0.617 y anteriores permite que atacantes remotos inyecten script web arbitrario o HTML mediante tags anidadas " [URL]BBCode". • https://www.exploit-db.com/exploits/1106 •