Vulnerabilities > E107 > E107 > 0.7.13
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2010-05-27 | CVE-2010-2098 | SQL-Injection vulnerability in E107 Incomplete blacklist vulnerability in usersettings.php in e107 0.7.20 and earlier allows remote attackers to conduct SQL injection attacks via the loginname parameter. | 7.5 |
| 2010-04-20 | CVE-2010-0997 | Cross-Site Scripting vulnerability in E107 Cross-site scripting (XSS) vulnerability in 107_plugins/content/content_manager.php in the Content Management plugin in e107 before 0.7.20, when the personal content manager is enabled, allows user-assisted remote authenticated users to inject arbitrary web script or HTML via the content_heading parameter. | 3.5 |
| 2010-04-20 | CVE-2010-0996 | Unspecified vulnerability in E107 Unrestricted file upload vulnerability in e107 before 0.7.20 allows remote authenticated users to execute arbitrary code by uploading a .php.filetypesphp file. network e107 | 6.0 |
| 2009-11-29 | CVE-2009-4084 | SQL Injection vulnerability in E107 SQL injection vulnerability in the search feature in e107 0.7.16 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors. | 7.5 |
| 2009-11-29 | CVE-2009-4083 | Cross-Site Scripting vulnerability in E107 Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.16 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors in (1) submitnews.php, (2) usersettings.php; and (3) newpost.php, (4) banlist.php, (5) banner.php, (6) cpage.php, (7) download.php, (8) users_extended.php, (9) frontpage.php, (10) links.php, and (11) mailout.php in e107_admin/. | 4.3 |
| 2009-09-28 | CVE-2009-3444 | Cross-Site Scripting vulnerability in E107 Cross-site scripting (XSS) vulnerability in email.php in e107 0.7.16 and earlier allows remote attackers to inject arbitrary web script or HTML via the HTTP Referer header in a news.1 (aka news to email) action. | 4.3 |
| 2009-04-24 | CVE-2009-1409 | SQL Injection vulnerability in E107 SQL injection vulnerability in usersettings.php in e107 0.7.15 and earlier, when "Extended User Fields" is enabled and magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the hide parameter, a different vector than CVE-2005-4224 and CVE-2008-5320. | 5.1 |
| 2008-12-03 | CVE-2008-5320 | SQL Injection vulnerability in E107 SQL injection vulnerability in usersettings.php in e107 0.7.13 and earlier allows remote authenticated users to execute arbitrary SQL commands via the ue[] parameter. | 6.5 |