Login Request a demo
Unscored severity · published Nov 6, 2005
CVE-2005-3521
SQL injection vulnerability in resetcore.php in e107 0.617 through 0.6173 allows remote attackers to execute arbitrary SQL commands, bypass authentication, and inject HTML or…
–
CVSS
1.6%
EPSS
No
On KEV
Description
SQL injection vulnerability in resetcore.php in e107 0.617 through 0.6173 allows remote attackers to execute arbitrary SQL commands, bypass authentication, and inject HTML or script via the (1) a_name parameter or (2) user field of the login page.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
E1
E107 · E107
0.617; 0.6171; 0.6172 · source: NVD
Affected product
E1
E107
E107
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2005-3521
CVE.org
https://www.cve.org/CVERecord?id=CVE-2005-3521
Patch
http://e107.org/news.php
marc.info
http://marc.info/?l=bugtraq&m=112967223222966&w=2
Patch
http://secunia.com/advisories/17237/
Exploit
http://securitytracker.com/id?1015069
www.osvdb.org
http://www.osvdb.org/20070
Exploit
http://www.securityfocus.com/bid/15125
More from E107
9.8
CVE-2026-72599
e107 e107 - SQL Injection
8.8
CVE-2021-27885
usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism
8.8
CVE-2016-10753
e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC
8.8
CVE-2018-15901
e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including administrators
8.1
CVE-2025-11941
e107 CMS Avatar image.php path traversal