| Package | Affected versions | Patched versions |
|---|---|---|
| e107 | = 0.7.0= 0.7.1= 0.7.10= 0.7.11= 0.7.12= 0.7.13= 0.7.14= 0.7.15= 0.7.16= 0.7.17= 0.7.18= 0.7.19= 0.7.2= 0.7.20= 0.7.21= 0.7.22= 0.7.24= 0.7.26= 0.7.3= 0.7.4= 0.7.5= 0.7.6= 0.7.7= 0.7.8= 0.7.9= 1.0.1= 1.0.2= 1.0.3≤ 1.0.4 |
fpw.php in e107 through 1.0.4 does not check the user_ban field, which makes it easier for remote attackers to reset passwords by sending a pwsubmit request and leveraging access to the e-mail account of a banned user.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free