E107 vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-72599 An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter.Critical 9.8 · Aug 11, 2026
• CVE-2021-47937 e107 CMS 2.3.0 contains a remote code execution vulnerability that allows authenticated users with theme installation permissions to execute arbitrary commands High 8.7 · May 10, 2026
• CVE-2022-50939 e107 CMS version 3.2.1 contains a critical file upload vulnerability that allows authenticated administrators to override arbitrary server files through path trHigh 8.6 · Jan 13, 2026
• CVE-2022-50916 e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrators to override server files through the Media Manager import fHigh 8.7 · Jan 13, 2026
• CVE-2022-50907 e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrative users to bypass upload restrictions and execute PHP files.High 8.6 · Jan 13, 2026
• CVE-2022-50905 e107 CMS version 3.2.1 contains multiple vulnerabilities that allow cross-site scripting (XSS) attacks.Critical 9.8 · Jan 13, 2026
• CVE-2021-27885 usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism.High 8.8 · Mar 2, 2021
• CVE-2016-10753 e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC.High 8.8 · May 24, 2019
• CVE-2018-16388 e107_web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content typHigh 7.2 · Sep 12, 2018
• CVE-2018-15901 e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including administrators.High 8.8 · Aug 28, 2018
• CVE-2016-10378 e107 2.1.1 allows SQL injection by remote authenticated administrators via the pagelist parameter to e107_admin/menus.php, related to the menuSaveVisibility funHigh 7.2 · May 29, 2017
• CVE-2011-1513 Static code injection vulnerability in install_.php in e107 CMS 0.7.24 and probably earlier versions, when the installation script is not removed, allows remoteHigh 7.5 · Nov 4, 2011
• CVE-2010-2099 bbcode/php.bb in e107 0.7.20 and earlier does not perform access control checks for all inputs that could contain the php bbcode tag, which allows remote attackHigh 7.5 · May 27, 2010
• CVE-2010-2098 Incomplete blacklist vulnerability in usersettings.php in e107 0.7.20 and earlier allows remote attackers to conduct SQL injection attacks via the loginname parHigh 7.5 · May 27, 2010
• CVE-2009-4084 SQL injection vulnerability in the search feature in e107 0.7.16 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.High 7.5 · Nov 29, 2009
• CVE-2008-4786 SQL injection vulnerability in easyshop.php in the EasyShop plugin for e107 allows remote attackers to execute arbitrary SQL commands via the category_id parameHigh 7.5 · Oct 29, 2008
• CVE-2008-4785 SQL injection vulnerability in newuser.php in the alternate_profiles plugin, possibly 0.2, for e107 allows remote attackers to execute arbitrary SQL commands viHigh 7.5 · Oct 29, 2008
• CVE-2008-2020 The CAPTCHA implementation as used in (1) Francisco Burzi PHP-Nuke 7.0 and 8.1, (2) my123tkShop e-Commerce-Suite (aka 123tkShop) 0.9.1, (3) phpMyBitTorrent 1.2.High 7.5 · Apr 29, 2008
• CVE-2006-5786 Directory traversal vulnerability in class2.php in e107 0.7.5 and earlier allows remote attackers to read and execute PHP code in arbitrary files via ".." sequeHigh 7.5 · Nov 7, 2006
• CVE-2006-4548 e107 0.75 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash High 7.5 · Sep 5, 2006
• CVE-2005-4224 Multiple "potential" SQL injection vulnerabilities in e107 0.7 might allow remote attackers to execute arbitrary SQL commands via (1) the email, hideemail, imagHigh 7.5 · Dec 14, 2005
• CVE-2005-3521 SQL injection vulnerability in resetcore.php in e107 0.617 through 0.6173 allows remote attackers to execute arbitrary SQL commands, bypass authentication, and High 7.5 · Nov 6, 2005
• CVE-2005-2559 doping.php in ePing plugin 1.02 and earlier for e107 portal allows remote attackers to execute arbitrary code or overwrite files via (1) shell metacharacters inHigh 7.5 · Aug 16, 2005
• CVE-2005-1949 The eping_validaddr function in functions.php for the ePing plugin for e107 portal allows remote attackers to execute arbitrary commands via shell metacharacterHigh 7.5 · Jun 16, 2005
• CVE-2005-1966 The eTrace_validaddr function in eTrace plugin for e107 portal allows remote attackers to execute arbitrary commands via shell metacharacters after a valid arguHigh 7.5 · Jun 10, 2005