Unscored severity · published Jun 27, 2007
CVE-2007-3429
Unrestricted file upload vulnerability in signup.php in e107 0.7.8 and earlier, when photograph upload is enabled, allows remote attackers to upload and execute arbitrary PHP code…
–
CVSS
2.1%
EPSS
No
On KEV
Description
Unrestricted file upload vulnerability in signup.php in e107 0.7.8 and earlier, when photograph upload is enabled, allows remote attackers to upload and execute arbitrary PHP code via a filename with a double extension such as .php.jpg.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
E1
E107 · E107
0.7; 0.7.1; 0.7.2; 0.7.3; 0.7.4; 0.7.5; +3 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-3429
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-3429
osvdb.org
http://osvdb.org/45426
www.g00ns-forum.net
http://www.g00ns-forum.net/showthread.php?t=9388
www.securityfocus.com
http://www.securityfocus.com/bid/24609
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/35022
www.exploit-db.com
https://www.exploit-db.com/exploits/4099
More from E107
9.8
CVE-2026-72599
e107 e107 - SQL Injection
8.8
CVE-2021-27885
usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism
8.8
CVE-2016-10753
e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC
8.8
CVE-2018-15901
e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including administrators
8.1
CVE-2025-11941
e107 CMS Avatar image.php path traversal