PT-2026-2381 · E107 Cms · E107 Cms

Hubert Wojciechowski · Publicado 2026-01-13 · Atualizado 2026-01-21 · CVE-2022-50905

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions e107 CMS version 3.2.1

Description e107 CMS version 3.2.1 is affected by multiple cross-site scripting (XSS) issues. A reflected XSS exists in the news comment functionality, triggered when authenticated users interact with the comment form. An attacker can inject malicious JavaScript code through a URL parameter, which executes when users click outside the comment field after typing content. Additionally, an upload restriction bypass for authenticated administrators allows the upload of SVG files containing malicious code via the media manager’s remote URL upload feature, leading to stored XSS when these files are accessed. The affected components are news.php and image.php.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, sanitize all user inputs in the comment form of the news.php component. Restrict administrator privileges to prevent unauthorized file uploads through the media manager in the image.php component.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2022-50905

Produtos afetados

E107 Cms

Referências · 9

• 🔥 https://exploit-db.com/exploits/50910 · Exploit
• https://vulncheck.com/advisories/e-cms-reflected-xss-via-comment-flow · Nota
• https://twitter.com/CVEnew/status/2011759626610528464 · Publicação no Twitter
• https://e107.org/download · Nota
• https://osv.dev/vulnerability/CVE-2022-50905 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-50905 · Nota de Segurança
• https://t.me/cveNotify/149397 · Publicação no Telegram
• https://t.me/cveNotify/149316 · Publicação no Telegram
• https://e107.org · Nota