CVSS: 7.5EPSS: 0%CPEs: 63EXPL: 0CVE-2010-2098
https://notcve.org/view.php?id=CVE-2010-2098
Incomplete blacklist vulnerability in usersettings.php in e107 0.7.20 and earlier allows remote attackers to conduct SQL injection attacks via the loginname parameter. Vulnerabilidad de lista negra incompleta en usersettings.php en e107 v0.7.20 y anteriores permite a atacantes remotos realizar ataques de inyección SQL a través del parámetro loginname. • http://e107.svn.sourceforge.net/viewvc/e107/trunk/e107_0.7/usersettings.php?r1=11521&r2=11538 http://e107.svn.sourceforge.net/viewvc/e107/trunk/e107_0.7/usersettings.php?r1=11538&r2=11541 http://php-security.org/2010/05/15/mops-2010-029-cmsqlite-c-parameter-sql-injection-vulnerability/index.html •
CVSS: 7.5EPSS: 1%CPEs: 63EXPL: 3CVE-2010-2099 – e107 - Code Exection
https://notcve.org/view.php?id=CVE-2010-2099
bbcode/php.bb in e107 0.7.20 and earlier does not perform access control checks for all inputs that could contain the php bbcode tag, which allows remote attackers to execute arbitrary PHP code, as demonstrated using the toEmail method in contact.php, related to invocations of the toHTML method. bbcode/php.bb en e107 v0.7.20 y anteriores, no realiza una validación del control de acceso para las entradas que podrían contener la etiqueta php "bbcode", lo que permite a atacantes remotos ejecutar código PHP de su elección, como se ha demostrado empleando el método toEmail en contact.php. Relacionado con la invocación del método toHTML. • https://www.exploit-db.com/exploits/12715 http://php-security.org/2010/05/19/mops-2010-035-e107-bbcode-remote-php-code-execution-vulnerability/index.html http://www.securityfocus.com/bid/40252 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.0EPSS: 2%CPEs: 66EXPL: 0CVE-2010-0996
https://notcve.org/view.php?id=CVE-2010-0996
Unrestricted file upload vulnerability in e107 before 0.7.20 allows remote authenticated users to execute arbitrary code by uploading a .php.filetypesphp file. NOTE: the vendor disputes the significance of this issue, noting that "an odd set of preferences and a missing file" are required. Vulnerabilidad de subida de fichero sin restricciones en e107 en versiones anteriores a la v0.7.20. Permite a usuarios remotos autenticados ejecutar comandos de su elección subiendo un fichero .php.filetypesphp. NOTA: el fabricante cuestiona la importancia de esta vulnerabilidad, arguyendo que se necesita "un conjunto poco común de preferencias y un fichero perdido". • http://e107.org/comment.php?comment.news.864 http://e107.org/svn_changelog.php?version=0.7.20 http://secunia.com/advisories/39013 http://secunia.com/secunia_research/2010-44 http://www.securityfocus.com/archive/1/510805/100/0/threaded http://www.securityfocus.com/bid/39540 http://www.vupen.com/english/advisories/2010/0919 https://exchange.xforce.ibmcloud.com/vulnerabilities/57932 •
CVSS: 3.5EPSS: 0%CPEs: 20EXPL: 0CVE-2010-0997
https://notcve.org/view.php?id=CVE-2010-0997
Cross-site scripting (XSS) vulnerability in 107_plugins/content/content_manager.php in the Content Management plugin in e107 before 0.7.20, when the personal content manager is enabled, allows user-assisted remote authenticated users to inject arbitrary web script or HTML via the content_heading parameter. Vulnerabilidad de secuencias de comandos en sitios cruzados en 107_plugins/content/content_manager.php en el complemento -plugin- Content Management de e107 anterior a v0.7.20, cuando el gestor de contenido personal está habilitado, permite a usuarios autenticados en remoto asistidos por usuarios locales inyectar secuencias de comandos Web o HTML mediante el parámetro content_heading. • http://e107.org/comment.php?comment.news.864 http://e107.org/svn_changelog.php?version=0.7.20 http://secunia.com/advisories/39013 http://secunia.com/secunia_research/2010-43 http://www.securityfocus.com/archive/1/510809/100/0/threaded http://www.securityfocus.com/bid/39539 http://www.vupen.com/english/advisories/2010/0919 https://exchange.xforce.ibmcloud.com/vulnerabilities/57933 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 58EXPL: 0CVE-2009-4083
https://notcve.org/view.php?id=CVE-2009-4083
Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.16 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in (1) submitnews.php, (2) usersettings.php; and (3) newpost.php, (4) banlist.php, (5) banner.php, (6) cpage.php, (7) download.php, (8) users_extended.php, (9) frontpage.php, (10) links.php, and (11) mailout.php in e107_admin/. NOTE: this may overlap CVE-2004-2040 and CVE-2006-4794, but there are insufficient details to be certain. Múltiples vulnerabilidades de ejecución de comandos en sitios cruzados(XSS) en e107 v0.7.16 y anteriores permite a atacantes remotos permite a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través de vectores no especificados en (1) submitnews.php, (2) usersettings.php; y (3) newpost.php, (4) banlist.php, (5) banner.php, (6) cpage.php, (7) download.php, (8) users_extended.php, (9) frontpage.php, (10) links.php, y(11) mailout.php en e107_admin/. NOTA: esta vulnerabilidad puede solaparse con CVE-2004-2040 y CVE-2006-4794, pero no hay suficientes detalles para tener certeza. • http://blog.bkis.com/e107-multiple-vulnerabilities http://www.securityfocus.com/archive/1/508007/100/0/threaded http://www.securityfocus.com/bid/37087 https://exchange.xforce.ibmcloud.com/vulnerabilities/54372 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •