Login Request a demo
E1
Product
e107
by e107 · last CVE Aug 11, 2026
78
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities78In the news0Timeline
Severity mix
Critical 1High 10Medium 11Low 0
Severity
All severities78Critical1High10Medium11Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add e107 to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-61505
6.5
0%
Oct 10
e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the `install.php` script
Affected: through 2.3.3
CVE-2018-16389
6.5
1%
Sep 12
e107_admin/banlist.php in e107 2.1.8 allows SQL injection via the old_ip parameter
Affected: 2.1.8
CVE-2018-11127
6.5
1%
May 15
e107 2.1.7 has CSRF resulting in arbitrary user deletion
Affected: 2.1.7
CVE-2017-8098
6.5
1%
Apr 24
e107 2.1.4 is vulnerable to cross-site request forgery in plugin-installing, meta-changing, and settings-changing
Affected: 2.1.4
CVE-2022-50905
6.1
1%
Jan 13
e107 CMS v3.2.1 - Reflected XSS via Comment Flow
Affected: 3.2.1
CVE-2018-11734
6.1
1%
Jul 10
In e107 v2.1.7, output without filtering results in XSS
Affected: 2.1.7
CVE-2018-16381
6.1
1%
Sep 5
e107 2.1.8 has XSS via the e107_admin/users.php?mode=main&action=list user_loginname parameter
Affected: 2.1.8
CVE-2023-36121
5.4
1%
Aug 2
Cross Site Scripting vulnerability in e107 v.2.3.2 allows a remote attacker to execute arbitrary code via the description function in the SEO project
Affected: 2.3.2
CVE-2022-50906
4.8
0%
Jan 13
e107 CMS v3.2.1 - Admin Upload Restriction Bypass + Stored XSS
Affected: 3.2.1
CVE-2018-17423
4.8
1%
Jun 19
An issue was discovered in e107 v2.1.9
Affected: 2.1.9
CVE-2018-17081
4.3
1%
Sep 26
e107 2.1.9 allows CSRF via e107_admin/wmessage.php?mode=&action=inline&ajax_used=1&id= for changing the title of an arbitrary page
Affected: 2.1.9
Showing 11