Skip to content
Noroxi

e107 records

91 published records for vendor e107.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
26
With a fix record
0%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 18
  3. 19
  4. 21
  5. 23
  6. 25
  7. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

91 records
  • CVE-2008-1989
    41Plan

    PHP remote file inclusion vulnerability in 123flashchat.php in the 123 Flash Chat 6.8.0 module for e107, when register_globals is enabled, a

    CriticalCVSS 10.0Proof of conceptEPSS 3%

    123flashchat · 123 flash chat moduleApr 27, 2008

  • CVE-2021-27885
    36Monitor

    usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism.

    HighCVSS 8.8Proof of conceptEPSS 3%

    e107 · e107Mar 2, 2021

  • CVE-2016-10753
    35Monitor

    e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC.

    HighCVSS 8.8No exploitEPSS 1%

    e107 · e107May 24, 2019

  • CVE-2018-15901
    35Monitor

    e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including administrators.

    HighCVSS 8.8No exploitEPSS 0%

    e107 · e107Aug 28, 2018

  • CVE-2004-2262
    34Monitor

    ImageManager in e107 before 0.617 does not properly check the types of uploaded files, which allows remote attackers to execute arbitrary co

    HighCVSS 7.5Proof of conceptEPSS 14%

    e107 · e107Dec 31, 2004

  • CVE-2022-50939
    34Monitor

    e107 CMS v3.2.1 - Upload Restriction Bypass with Path Traversal File Override

    HighCVSS 8.6No exploitEPSS 1%

    e107 · e107Jan 13, 2026

  • CVE-2022-50907
    34Monitor

    e107 CMS v3.2.1 - Admin Upload Restriction Bypass + RCE

    HighCVSS 8.6No exploitEPSS 1%

    e107 · e107Jan 13, 2026

  • CVE-2022-50916
    34Monitor

    e107 CMS v3.2.1 - Upload restriction bypass (Authenticated [Admin])+ Server file override

    HighCVSS 8.7No exploitEPSS 0%

    e107 · e107Jan 13, 2026

  • CVE-2011-1513
    32Monitor

    Static code injection vulnerability in install_.php in e107 CMS 0.7.24 and probably earlier versions, when the installation script is not re

    HighCVSS 7.5Proof of conceptEPSS 5%

    e107 · e107Nov 4, 2011

  • CVE-2010-2099
    31Monitor

    bbcode/php.bb in e107 0.7.20 and earlier does not perform access control checks for all inputs that could contain the php bbcode tag, which

    HighCVSS 7.5Proof of conceptEPSS 4%

    e107 · e107May 27, 2010

  • CVE-2008-6438
    31Monitor

    SQL injection vulnerability in macgurublog_menu/macgurublog.php in the MacGuru BLOG Engine plugin 2.2 for e107 allows remote attackers to ex

    HighCVSS 7.5Proof of conceptEPSS 3%

    e107 · e107Mar 6, 2009

  • CVE-2006-5786
    31Monitor

    Directory traversal vulnerability in class2.php in e107 0.7.5 and earlier allows remote attackers to read and execute PHP code in arbitrary

    HighCVSS 7.5Proof of conceptEPSS 2%

    e107 · e107Nov 7, 2006

  • CVE-2005-2559
    31Monitor

    doping.php in ePing plugin 1.02 and earlier for e107 portal allows remote attackers to execute arbitrary code or overwrite files via (1) she

    HighCVSS 7.5No exploitEPSS 2%

    e107 · e107Aug 16, 2005

  • CVE-2005-1949
    31Monitor

    The eping_validaddr function in functions.php for the ePing plugin for e107 portal allows remote attackers to execute arbitrary commands via

    HighCVSS 7.5No exploitEPSS 2%

    e107 · e107Jun 16, 2005

  • CVE-2004-2041
    31Monitor

    PHP remote file inclusion vulnerability in secure_img_render.php in e107 0.615 allows remote attackers to execute arbitrary PHP code by modi

    HighCVSS 7.5No exploitEPSS 2%

    e107 · e107May 29, 2004

  • CVE-2004-2042
    31Monitor

    Multiple SQL injection vulnerabilities in e107 0.615 allow remote attackers to inject arbitrary SQL code and gain sensitive information via

    HighCVSS 7.5No exploitEPSS 1%

    e107 · e107May 29, 2004

  • CVE-2005-1966
    31Monitor

    The eTrace_validaddr function in eTrace plugin for e107 portal allows remote attackers to execute arbitrary commands via shell metacharacter

    HighCVSS 7.5No exploitEPSS 1%

    e107 · e107Jun 10, 2005

  • CVE-2005-4224
    31Monitor

    Multiple "potential" SQL injection vulnerabilities in e107 0.7 might allow remote attackers to execute arbitrary SQL commands via (1) the em

    HighCVSS 7.5No exploitEPSS 1%

    e107 · e107Dec 14, 2005

  • CVE-2006-4548
    31Monitor

    e107 0.75 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumer

    HighCVSS 7.5No exploitEPSS 1%

    e107 · e107Sep 5, 2006

  • CVE-2008-2020
    31Monitor

    The CAPTCHA implementation as used in (1) Francisco Burzi PHP-Nuke 7.0 and 8.1, (2) my123tkShop e-Commerce-Suite (aka 123tkShop) 0.9.1, (3)

    HighCVSS 7.5No exploitEPSS 1%

    my123tkshop · e-commerce-suiteApr 29, 2008

  • CVE-2005-3521
    30Monitor

    SQL injection vulnerability in resetcore.php in e107 0.617 through 0.6173 allows remote attackers to execute arbitrary SQL commands, bypass

    HighCVSS 7.5No exploitEPSS 1%

    e107 · e107Nov 6, 2005

  • CVE-2008-4906
    30Monitor

    SQL injection vulnerability in lyrics_song.php in the Lyrics (lyrics_menu) plugin 0.42 for e107 allows remote attackers to execute arbitrary

    HighCVSS 7.5Proof of conceptEPSS 1%

    e107 · e107Nov 3, 2008

  • CVE-2008-6114
    30Monitor

    SQL injection vulnerability in product_details.php in the Mytipper Zogo-shop 1.15.4 plugin for e107 allows remote attackers to execute arbit

    HighCVSS 7.5Proof of conceptEPSS 1%

    mytipper · zogo shopFeb 11, 2009

  • CVE-2009-4084
    30Monitor

    SQL injection vulnerability in the search feature in e107 0.7.16 and earlier allows remote attackers to execute arbitrary SQL commands via u

    HighCVSS 7.5No exploitEPSS 1%

    e107 · e107Nov 29, 2009

  • CVE-2010-2098
    30Monitor

    Incomplete blacklist vulnerability in usersettings.php in e107 0.7.20 and earlier allows remote attackers to conduct SQL injection attacks v

    HighCVSS 7.5No exploitEPSS 1%

    e107 · e107May 27, 2010