CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 13/01/2026 |
| CVE-2022-50906 | 보통4.8 | e107 CMS 3.2.1 contains an upload restriction bypass vulnerability that allows authenticated administrators to upload malicious SVG files through the media manager. Attackers with admin privileges can exploit this vulnerability to upload SVG files with embedded cross-site scripting (XSS) payloads that can execute arbit | 13/01/2026 |
| CVE-2022-50905 | 보통6.1 | e107 CMS version 3.2.1 contains multiple vulnerabilities that allow cross-site scripting (XSS) attacks. The first vulnerability is a reflected XSS that occurs in the news comment functionality when authenticated users interact with the comment form. An attacker can inject malicious JavaScript code through the URL param | 13/01/2026 |
| CVE-2025-11941 | 높음8.1 | A vulnerability was detected in e107 CMS up to 2.3.3. This impacts an unknown function of the file /e107_admin/image.php?mode=main&action=avatar of the component Avatar Handler. Performing manipulation of the argument multiaction[] results in path traversal. It is possible to initiate the attack remotely. The exploit i | 19/10/2025 |
| CVE-2025-61505 | 보통6.5 | e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the `install.php` script. The script processes user-controlled input in the `previous_steps` POST parameter using `unserialize(base64_decode())` without validation, allowing attackers to craft malicious serialized data. This could lead to remote code exe | 10/10/2025 |
| CVE-2023-43874 | 보통5.4 | Multiple Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script to the Copyright and Author fields in the Meta & Custom Tags Menu. | 28/09/2023 |
| CVE-2023-43873 | 보통5.4 | A Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script to the Name filed in the Manage Menu. | 28/09/2023 |
| CVE-2023-36121 | 보통5.4 | Cross Site Scripting vulnerability in e107 v.2.3.2 allows a remote attacker to execute arbitrary code via the description function in the SEO project. | 02/08/2023 |
| CVE-2021-27885 | 높음8.8 | usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism. | 02/03/2021 |
| CVE-2018-11734 | 보통6.1 | In e107 v2.1.7, output without filtering results in XSS. | 10/07/2019 |
| CVE-2018-17423 | 보통4.8 | An issue was discovered in e107 v2.1.9. There is a XSS attack on e107_admin/comment.php. | 19/06/2019 |
| CVE-2016-10753 | 높음8.8 | e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC. | 24/05/2019 |
| CVE-2018-17081 | 보통4.3 | e107 2.1.9 allows CSRF via e107_admin/wmessage.php?mode=&action=inline&ajax_used=1&id= for changing the title of an arbitrary page. | 26/09/2018 |
| CVE-2018-16389 | 보통6.5 | e107_admin/banlist.php in e107 2.1.8 allows SQL injection via the old_ip parameter. | 12/09/2018 |
| CVE-2018-16388 | 높음7.2 | e107_web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content type. | 12/09/2018 |
| CVE-2018-16381 | 보통6.1 | e107 2.1.8 has XSS via the e107_admin/users.php?mode=main&action=list user_loginname parameter. | 05/09/2018 |
| CVE-2018-15901 | 높음8.8 | e107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including administrators. | 28/08/2018 |
| CVE-2018-11127 | 보통6.5 | e107 2.1.7 has CSRF resulting in arbitrary user deletion. | 15/05/2018 |