Show filters
5 Total Results
Displaying 1-5 of 5
Sort by:
Attacker Value
Unknown

CVE-2013-7305

Disclosure Date: January 22, 2014 (last updated October 05, 2023)
fpw.php in e107 through 1.0.4 does not check the user_ban field, which makes it easier for remote attackers to reset passwords by sending a pwsubmit request and leveraging access to the e-mail account of a banned user.
0
0
Attacker Value
Unknown

CVE-2013-2750

Disclosure Date: January 22, 2014 (last updated October 05, 2023)
Cross-site scripting (XSS) vulnerability in e107_plugins/content/handlers/content_preset.php in e107 before 1.0.3 allows remote attackers to inject arbitrary web script or HTML via the query string.
0
0
Attacker Value
Unknown

CVE-2011-4946

Disclosure Date: August 31, 2012 (last updated October 05, 2023)
SQL injection vulnerability in e107_admin/users_extended.php in e107 before 0.7.26 allows remote attackers to execute arbitrary SQL commands via the user_field parameter.
0
0
Attacker Value
Unknown

CVE-2011-4947

Disclosure Date: August 31, 2012 (last updated October 05, 2023)
Cross-site request forgery (CSRF) vulnerability in e107_admin/users_extended.php in e107 before 0.7.26 allows remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences via the user_include parameter.
0
0
Attacker Value
Unknown

CVE-2011-1513

Disclosure Date: November 04, 2011 (last updated October 04, 2023)
Static code injection vulnerability in install_.php in e107 CMS 0.7.24 and probably earlier versions, when the installation script is not removed, allows remote attackers to inject arbitrary PHP code into e107_config.php via a crafted MySQL server name.
0
0