Login Request a demo
E1
Vendor
e107
7 products with CVEs on record
91
CVEs
0
On KEV
0
New 30D
Products
E1
e107
e107
9.8
78 CVEs0 on KEV0 new
EC
e107 CMS
e107
8.8
8 CVEs0 on KEV0 new
AP
Alternate Profiles Plugin
E107
–
1 CVEs0 on KEV0 new
CP
Chatbox Plugin
E107
–
1 CVEs0 on KEV0 new
CM
CMS
e107
8.1
1 CVEs0 on KEV0 new
EP
Easyshop Plugin
E107
–
1 CVEs0 on KEV0 new
MG
MY Gallery
E107
–
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-72599
E1
e107
e107
9.8
1%
Aug 11e107 e107 - SQL Injection
CVE-2021-47937
EC
e107 CMS
E107
8.8
1%
May 10e107 CMS 2.3.0 Authenticated Remote Code Execution via Theme Upload
CVE-2022-50939
EC
e107 CMS
E107
7.2
1%
Jan 13e107 CMS v3.2.1 - Upload Restriction Bypass with Path Traversal File Override
CVE-2022-50916
EC
e107 CMS
e107
7.2
1%
Jan 13e107 CMS v3.2.1 - Upload restriction bypass (Authenticated [Admin])+ Server file override
CVE-2022-50907
EC
e107 CMS
e107
7.2
1%
Jan 13e107 CMS v3.2.1 - Admin Upload Restriction Bypass + RCE
CVE-2022-50906
EC
e107 CMS
e107
4.8
0%
Jan 13e107 CMS v3.2.1 - Admin Upload Restriction Bypass + Stored XSS
CVE-2022-50905
EC
e107 CMS
e107
6.1
1%
Jan 13e107 CMS v3.2.1 - Reflected XSS via Comment Flow
CVE-2025-11941
CM
CMS
e107
8.1
1%
Oct 19e107 CMS Avatar image.php path traversal
CVE-2025-61505
E1
E107
E107
6.5
0%
Oct 10e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the `install.php` script
CVE-2023-43874
EC
E107 Cms
E107
5.4
1%
Sep 28Multiple Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script to the Copyright and Author fields in…
CVE-2023-43873
EC
E107 Cms
E107
5.4
0%
Sep 28A Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script to the Name filed in the Manage Menu
CVE-2023-36121
E1
E107
E107
5.4
1%
Aug 2Cross Site Scripting vulnerability in e107 v.2.3.2 allows a remote attacker to execute arbitrary code via the description function in the SEO project
CVE-2021-27885
E1
E107
E107
8.8
3%
Mar 2usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism
CVE-2018-11734
E1
E107
E107
6.1
1%
Jul 10In e107 v2.1.7, output without filtering results in XSS
CVE-2018-17423
E1
E107
E107
4.8
1%
Jun 19An issue was discovered in e107 v2.1.9
CVE-2016-10753
E1
E107
E107
8.8
2%
May 24e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC
CVE-2018-17081
E1
E107
E107
4.3
1%
Sep 26e107 2.1.9 allows CSRF via e107_admin/wmessage.php?mode=&action=inline&ajax_used=1&id= for changing the title of an arbitrary page
CVE-2018-16389
E1
E107
E107
6.5
1%
Sep 12e107_admin/banlist.php in e107 2.1.8 allows SQL injection via the old_ip parameter
CVE-2018-16388
E1
E107
E107
7.2
2%
Sep 12e107_web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content type
CVE-2018-16381
E1
E107
E107
6.1
1%
Sep 5e107 2.1.8 has XSS via the e107_admin/users.php?mode=main&action=list user_loginname parameter
CVE-2018-15901
E1
E107
E107
8.8
1%
Aug 28e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including administrators
CVE-2018-11127
E1
E107
E107
6.5
1%
May 15e107 2.1.7 has CSRF resulting in arbitrary user deletion
CVE-2016-10378
E1
E107
E107
7.2
1%
May 29e107 2.1.1 allows SQL injection by remote authenticated administrators via the pagelist parameter to e107_admin/menus.php, related to the menuSaveVisibility function
CVE-2017-8098
E1
E107
E107
6.5
1%
Apr 24e107 2.1.4 is vulnerable to cross-site request forgery in plugin-installing, meta-changing, and settings-changing
CVE-2015-1057
E1
E107
E107
–
3%
Jan 16Cross-site scripting (XSS) vulnerability in usersettings.php in e107 2.0.0 allows remote attackers to inject arbitrary web script or HTML via the "Real Name" value
CVE-2015-1041
E1
E107
E107
–
3%
Jan 15Cross-site scripting (XSS) vulnerability in e107_admin/filemanager.php in e107 1.0.4 allows remote attackers to inject arbitrary web script or HTML via the e107_files/ file path…
CVE-2014-9459
E1
E107
E107
–
1%
Jan 2Cross-site request forgery (CSRF) vulnerability in the AdminObserver function in e107_admin/users.php in e107 2.0 alpha2 allows remote attackers to hijack the authentication of…
CVE-2014-4734
E1
E107
E107
–
2%
Jul 21Cross-site scripting (XSS) vulnerability in e107_admin/db.php in e107 2.0 alpha2 and earlier allows remote attackers to inject arbitrary web script or HTML via the type parameter
CVE-2013-7305
E1
E107
E107
–
1%
Jan 22fpw.php in e107 through 1.0.4 does not check the user_ban field, which makes it easier for remote attackers to reset passwords by sending a pwsubmit request and leveraging access…
CVE-2013-2750
E1
E107
E107
–
3%
Jan 22Cross-site scripting (XSS) vulnerability in e107_plugins/content/handlers/content_preset.php in e107 before 1.0.3 allows remote attackers to inject arbitrary web script or HTML…
CVE-2012-6434
E1
E107
E107
–
1%
Jan 3Multiple cross-site request forgery (CSRF) vulnerabilities in e107_admin/download.php in e107 1.0.2 allow remote attackers to hijack the authentication of administrators for…
CVE-2012-6433
E1
E107
E107
–
2%
Jan 3Cross-site request forgery (CSRF) vulnerability in e107_admin/newspost.php in e107 1.0.1 allows remote attackers to hijack the authentication of administrators for requests that…
CVE-2011-4947
E1
E107
E107
–
1%
Aug 31Cross-site request forgery (CSRF) vulnerability in e107_admin/users_extended.php in e107 before 0.7.26 allows remote attackers to hijack the authentication of administrators for…
CVE-2011-4946
E1
E107
E107
–
1%
Aug 31SQL injection vulnerability in e107_admin/users_extended.php in e107 before 0.7.26 allows remote attackers to execute arbitrary SQL commands via the user_field parameter
CVE-2012-3843
E1
E107
E107
–
1%
Jul 3Cross-site scripting (XSS) vulnerability in the registration page in e107, probably 1.0.1, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors
CVE-2010-5084
E1
E107
E107
–
0%
Feb 14The cross-site request forgery (CSRF) protection mechanism in e107 before 0.7.23 uses a predictable random token based on the creation date of the administrator account, which…
CVE-2011-4921
E1
E107
E107
–
1%
Jan 4SQL injection vulnerability in usersettings.php in e107 0.7.26, and possibly other versions before 1.0.0, allows remote attackers to execute arbitrary SQL commands via the…
CVE-2011-4920
E1
E107
E107
–
1%
Jan 4Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.26, and other versions before 1.0.0, allow remote attackers to inject arbitrary web script or HTML via the URL to…
CVE-2011-1513
E1
E107
E107
–
6%
Nov 4Static code injection vulnerability in install_.php in e107 CMS 0.7.24 and probably earlier versions, when the installation script is not removed, allows remote attackers to…
CVE-2011-3731
E1
E107
E107
–
1%
Sep 23e107 0.7.24 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated…
CVE-2010-4757
E1
E107
E107
–
1%
Mar 15Cross-site scripting (XSS) vulnerability in submitnews.php in e107 before 0.7.23 allows remote attackers to inject arbitrary web script or HTML via the submitnews_title parameter,…
CVE-2011-0457
E1
E107
E107
–
1%
Mar 15Cross-site scripting (XSS) vulnerability in e107 0.7.22 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors
CVE-2010-2099
E1
E107
E107
–
5%
May 27bbcode/php.bb in e107 0.7.20 and earlier does not perform access control checks for all inputs that could contain the php bbcode tag, which allows remote attackers to execute…
CVE-2010-2098
E1
E107
E107
–
1%
May 27Incomplete blacklist vulnerability in usersettings.php in e107 0.7.20 and earlier allows remote attackers to conduct SQL injection attacks via the loginname parameter
CVE-2010-0997
E1
E107
E107
–
1%
Apr 20Cross-site scripting (XSS) vulnerability in 107_plugins/content/content_manager.php in the Content Management plugin in e107 before 0.7.20, when the personal content manager is…
CVE-2010-0996
E1
E107
E107
–
2%
Apr 20Unrestricted file upload vulnerability in e107 before 0.7.20 allows remote authenticated users to execute arbitrary code by uploading a .php.filetypesphp file
CVE-2009-4084
E1
E107
E107
–
1%
Nov 29SQL injection vulnerability in the search feature in e107 0.7.16 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors
CVE-2009-4083
E1
E107
E107
–
1%
Nov 29Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.16 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in (1)…
CVE-2009-3444
E1
E107
E107
–
2%
Sep 28Cross-site scripting (XSS) vulnerability in email.php in e107 0.7.16 and earlier allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header in a…
CVE-2009-1409
E1
E107
E107
–
1%
Apr 24SQL injection vulnerability in usersettings.php in e107 0.7.15 and earlier, when "Extended User Fields" is enabled and magic_quotes_gpc is disabled, allows remote attackers to…
CVE-2008-6208
E1
E107
E107
–
1%
Feb 20Cross-site scripting (XSS) vulnerability in submitnews.php in e107 CMS 0.7.11 allows remote attackers to inject arbitrary web script or HTML via the (1) author_name, (2)…
CVE-2008-5320
E1
E107
E107
–
2%
Dec 3SQL injection vulnerability in usersettings.php in e107 0.7.13 and earlier allows remote authenticated users to execute arbitrary SQL commands via the ue[] parameter
CVE-2008-4786
EP
Easyshop Plugin
E107
–
1%
Oct 29SQL injection vulnerability in easyshop.php in the EasyShop plugin for e107 allows remote attackers to execute arbitrary SQL commands via the category_id parameter
CVE-2008-4785
AP
Alternate Profiles Plugin
E107
–
1%
Oct 29SQL injection vulnerability in newuser.php in the alternate_profiles plugin, possibly 0.2, for e107 allows remote attackers to execute arbitrary SQL commands via the id parameter
CVE-2008-2020
E1
E107
E107
7.5
2%
Apr 30The CAPTCHA implementation as used in (1) Francisco Burzi PHP-Nuke 7.0 and 8.1, (2) my123tkShop e-Commerce-Suite (aka 123tkShop) 0.9.1, (3) phpMyBitTorrent 1.2.2, (4) TorrentFlux…
CVE-2008-1989
E1
E107
E107
–
4%
Apr 27PHP remote file inclusion vulnerability in 123flashchat.php in the 123 Flash Chat 6.8.0 module for e107, when register_globals is enabled, allows remote attackers to execute…
CVE-2008-1702
MG
MY Gallery
E107
–
6%
Apr 8Absolute path traversal vulnerability in dload.php in the my_gallery 2.3 plugin for e107 allows remote attackers to obtain sensitive information via a full pathname in the file…
CVE-2007-3429
E1
E107
E107
–
2%
Jun 27Unrestricted file upload vulnerability in signup.php in e107 0.7.8 and earlier, when photograph upload is enabled, allows remote attackers to upload and execute arbitrary PHP code…
CVE-2006-5786
E1
E107
E107
–
3%
Nov 7Directory traversal vulnerability in class2.php in e107 0.7.5 and earlier allows remote attackers to read and execute PHP code in arbitrary files via ".." sequences in the…
CVE-2006-4794
E1
E107
E107
–
5%
Sep 14Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.5 allow remote attackers to inject arbitrary web script or HTML via the query string (PATH_INFO) in (1)…