E107inc vulnerabilities
We track 5 vulnerabilities in E107inc products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on October 14, 2026.
Latest E107inc vulnerabilities
- 9.8 Critical severity
e107: Deserialization of Untrusted Data
e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting allowed classes. The in
- 10.0 Critical severity
e107: Improper Neutralization of Special Elements used in an SQL Command
e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e
- 7.5 High severity
e107: Deserialization of Untrusted Data
e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the user_prefs column. The e
- 7.1 High severity
e107: Improper Neutralization of Special Elements used in an OS Command
e107 is a content management system (CMS). Versions 2.3.5 and earlier contain a command injection vulnerability in the ImageMagick resize destination path. In resize_image(), the source path is escaped with escapeshellarg(), but the destination path is inserte
- 8.1 High severity
e107 is a content management system (CMS).
e107 is a content management system (CMS). Prior to 2.3.4, a Host Header Injection vulnerability in the password reset page allows attackers to manipulate the Host header to generate password reset links pointing to attacker-controlled domains. This can lead t