PT-2026-2382 · E107 Cms · E107 Cms

Hubert Wojciechowski · Publicado 2026-01-13 · Atualizado 2026-01-15 · CVE-2022-50906

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions e107 CMS version 3.2.1

Description An authenticated administrator can bypass upload restrictions in e107 CMS. This allows the upload of malicious SVG files through the media manager. Successful exploitation enables attackers to upload SVG files containing cross-site scripting (XSS) payloads. When viewed, these payloads can execute arbitrary scripts. The vulnerable functionality is related to file uploads via the media manager.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2022-50906

Produtos afetados

E107 Cms

Referências · 7

• 🔥 https://exploit-db.com/exploits/50910 · Exploit
• https://vulncheck.com/advisories/e-cms-admin-upload-restriction-bypass-stored-xss · Nota
• https://osv.dev/vulnerability/CVE-2022-50906 · Aviso do Fabricante
• https://e107.org · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2022-50906 · Nota de Segurança
• https://e107.org/download · Nota
• https://twitter.com/CVEnew/status/2011759625498976575 · Publicação no Twitter