CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 2CVE-2023-43873
https://notcve.org/view.php?id=CVE-2023-43873
28 Sep 2023 — A Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script to the Name filed in the Manage Menu. Vulnerabilidad de Cross Site Scripting (XSS) en e017 CMS v.2.3.2 permite a un atacante local ejecutar código arbitrario a través de un script manipulado para el Nombre archivado en el Menú Administrar. • https://github.com/sromanhu/CVE-2023-43873-e107-CMS-Stored-XSS---Manage • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 2CVE-2023-43874
https://notcve.org/view.php?id=CVE-2023-43874
28 Sep 2023 — Multiple Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script to the Copyright and Author fields in the Meta & Custom Tags Menu. Vulnerabilidad de múltiples Cross Site Scripting (XSS) en e017 CMS v.2.3.2 permite a un atacante local ejecutar código arbitrario a través de un script manipulado a en los campos Copyright y Autor en el Menú Meta y Etiquetas Personalizadas. • https://github.com/sromanhu/CVE-2023-43874-e107-CMS-Stored-XSS---MetaCustomTags • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 3CVE-2023-36121
https://notcve.org/view.php?id=CVE-2023-36121
01 Aug 2023 — Cross Site Scripting vulnerability in e107 v.2.3.2 allows a remote attacker to execute arbitrary code via the description function in the SEO project. La vulnerabilidad Cross-Site Scripting en e107 v.2.3.2 permite a un atacante remoto ejecutar código arbitrario a través de la función de descripción en el proyecto SEO. • https://github.com/Trinity-SYT-SECURITY/XSS_vuln_issue/blob/main/e107%20v2.3.2.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 2%CPEs: 66EXPL: 0CVE-2010-0996
https://notcve.org/view.php?id=CVE-2010-0996
20 Apr 2010 — Unrestricted file upload vulnerability in e107 before 0.7.20 allows remote authenticated users to execute arbitrary code by uploading a .php.filetypesphp file. NOTE: the vendor disputes the significance of this issue, noting that "an odd set of preferences and a missing file" are required. Vulnerabilidad de subida de fichero sin restricciones en e107 en versiones anteriores a la v0.7.20. Permite a usuarios remotos autenticados ejecutar comandos de su elección subiendo un fichero .php.filetypesphp. NOTA: el ... • http://e107.org/comment.php?comment.news.864 •
CVSS: 9.8EPSS: 0%CPEs: 68EXPL: 1CVE-2009-1409 – e107 < 0.7.15 - 'extended_user_fields' Blind SQL Injection
https://notcve.org/view.php?id=CVE-2009-1409
24 Apr 2009 — SQL injection vulnerability in usersettings.php in e107 0.7.15 and earlier, when "Extended User Fields" is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the hide parameter, a different vector than CVE-2005-4224 and CVE-2008-5320. Una vulnerabilidad de inyección de SQL en usersettings.php en e107 v0.7.15 y anteriores, cuando la opción "Campos de usuario extendidos" está activado y magic_quotes_gpc está desactivado, permite a atacantes remotos ejecutar... • https://www.exploit-db.com/exploits/8495 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 56EXPL: 2CVE-2008-5320 – e107 < 0.7.13 - 'usersettings.php' Blind SQL Injection
https://notcve.org/view.php?id=CVE-2008-5320
03 Dec 2008 — SQL injection vulnerability in usersettings.php in e107 0.7.13 and earlier allows remote authenticated users to execute arbitrary SQL commands via the ue[] parameter. Vulnerabilidad de inyección SQL en el archivo usersettings.php en e107 0.7.13 y versiones anteriores, permite a los usuarios remotos autentificados ejecutar arbitrariamente comandos SQL a través del parámetro ue[]. • https://www.exploit-db.com/exploits/6791 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 45EXPL: 0CVE-2006-0682
https://notcve.org/view.php?id=CVE-2006-0682
15 Feb 2006 — Multiple cross-site scripting (XSS) vulnerabilities in bbcodes system in e107 before 0.7.2 allow remote attackers to inject arbitrary web script or HTML via unknown attack vectors. • http://e107.org/comment.php?comment.news.776 •
CVSS: 6.1EPSS: 0%CPEs: 37EXPL: 2CVE-2005-2327 – e107 0.617 - Cross-Site Scripting Remote Cookie Disclosure
https://notcve.org/view.php?id=CVE-2005-2327
20 Jul 2005 — Cross-site scripting (XSS) vulnerability in e107 0.617 and earlier allows remote attackers to inject arbitrary web script or HTML via nested [url] BBCode tags. Vulnerabilidad de secuencia de comandos en sitios cruzados en e107 0.617 y anteriores permite que atacantes remotos inyecten script web arbitrario o HTML mediante tags anidadas " [URL]BBCode". • https://www.exploit-db.com/exploits/1106 •