Login Request a demo
E1
Product
e107
by e107 · last CVE Aug 11, 2026
78
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities78In the news0Timeline
Severity mix
Critical 1High 10Medium 11Low 0
Severity
All severities78Critical1High10Medium11Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add e107 to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2021-27885
8.8
3%
Mar 2
usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism
Affected: through 2.3.0
CVE-2016-10753
8.8
2%
May 24
e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC
Affected: 2.1.2
CVE-2018-15901
8.8
1%
Aug 28
e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including administrators
Affected: 2.1.8
CVE-2025-11941
8.1
1%
Oct 19
e107 CMS Avatar image.php path traversal
Affected: through 2.3.3
CVE-2008-2020
7.5
2%
Apr 30
The CAPTCHA implementation as used in (1) Francisco Burzi PHP-Nuke 7.0 and 8.1, (2) my123tkShop e-Commerce-Suite (aka 123tkShop) 0.9.1, (3) phpMyBitTorrent 1.2.2, (4) TorrentFlux…
Affected: 0.7.11
CVE-2022-50939
7.2
1%
Jan 13
e107 CMS v3.2.1 - Upload Restriction Bypass with Path Traversal File Override
Affected: 3.2.1
CVE-2022-50916
7.2
1%
Jan 13
e107 CMS v3.2.1 - Upload restriction bypass (Authenticated [Admin])+ Server file override
Affected: 3.2.1
CVE-2022-50907
7.2
1%
Jan 13
e107 CMS v3.2.1 - Admin Upload Restriction Bypass + RCE
Affected: 3.2.1
CVE-2018-16388
7.2
2%
Sep 12
e107_web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content type
Affected: 2.1.8
CVE-2016-10378
7.2
1%
May 29
e107 2.1.1 allows SQL injection by remote authenticated administrators via the pagelist parameter to e107_admin/menus.php, related to the menuSaveVisibility function
Affected: 2.1.1
Showing 10