E107

E107

77 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.8

CVE-2007-3429

  • EPSS 3.72%
  • Veröffentlicht 27.06.2007 00:30:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Unrestricted file upload vulnerability in signup.php in e107 0.7.8 and earlier, when photograph upload is enabled, allows remote attackers to upload and execute arbitrary PHP code via a filename with a double extension such as .php.jpg.

7.5

CVE-2006-5786

Exploit
  • EPSS 4.7%
  • Veröffentlicht 07.11.2006 23:07:00
  • Zuletzt bearbeitet 09.04.2025 00:30:58

Directory traversal vulnerability in class2.php in e107 0.7.5 and earlier allows remote attackers to read and execute PHP code in arbitrary files via ".." sequences in the e107language_e107cookie cookie to gsitemap.php.

4.3

CVE-2006-4794

Exploit
  • EPSS 1.1%
  • Veröffentlicht 14.09.2006 21:07:00
  • Zuletzt bearbeitet 03.04.2025 01:03:51

Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.5 allow remote attackers to inject arbitrary web script or HTML via the query string (PATH_INFO) in (1) contact.php, (2) download.php, (3) admin.php, (4) fpw.php, (5) news.php, (6) searc...

4.6

CVE-2006-4757

  • EPSS 0.41%
  • Veröffentlicht 13.09.2006 23:07:00
  • Zuletzt bearbeitet 03.04.2025 01:03:51

Multiple SQL injection vulnerabilities in the admin section in e107 0.7.5 allow remote authenticated administrative users to execute arbitrary SQL commands via the (1) linkopentype, (2) linkrender, (3) link_class, and (4) link_id parameters in (a) li...

7.5

CVE-2006-4548

Exploit
  • EPSS 1.46%
  • Veröffentlicht 06.09.2006 00:04:00
  • Zuletzt bearbeitet 03.04.2025 01:03:51

e107 0.75 and earlier does not properly unset variables when the input data includes a numeric parameter with a value matching an alphanumeric parameter's hash value, which allows remote attackers to execute arbitrary PHP code via the tinyMCE_imglib_...

4.3

CVE-2006-3259

Exploit
  • EPSS 9.05%
  • Veröffentlicht 27.06.2006 21:05:00
  • Zuletzt bearbeitet 03.04.2025 01:03:51

Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.5 allow remote attackers to inject arbitrary web script or HTML via the (1) ep parameter to search.php and the (2) subject parameter in comment.php (aka the Subject field when posting a ...

6.4

CVE-2006-2590

  • EPSS 0.33%
  • Veröffentlicht 25.05.2006 10:02:00
  • Zuletzt bearbeitet 03.04.2025 01:03:51

SQL injection vulnerability in e107 before 0.7.5 allows remote attackers to execute arbitrary SQL commands via unknown attack vectors.

5

CVE-2006-2591

  • EPSS 0.4%
  • Veröffentlicht 25.05.2006 10:02:00
  • Zuletzt bearbeitet 03.04.2025 01:03:51

Unspecified vulnerability in e107 before 0.7.5 has unknown impact and remote attack vectors related to an "emailing exploit".

5.1

CVE-2006-2416

  • EPSS 0.82%
  • Veröffentlicht 16.05.2006 10:02:00
  • Zuletzt bearbeitet 03.04.2025 01:03:51

SQL injection vulnerability in class2.php in e107 0.7.2 and earlier allows remote attackers to execute arbitrary SQL commands via a cookie as defined in $pref['cookie_name'].

4.3

CVE-2006-0857

  • EPSS 0.39%
  • Veröffentlicht 23.02.2006 23:02:00
  • Zuletzt bearbeitet 03.04.2025 01:03:51

Cross-site scripting (XSS) vulnerability in Chatbox Plugin 1.0 in e107 0.7.2 allows remote attackers to inject arbitrary HTML or web script via a Chatbox, as demonstrated using a SCRIPT element.