PT-2026-2381 · E107 Cms · E107 Cms

Hubert Wojciechowski · Published 2026-01-13 · Updated 2026-01-21 · CVE-2022-50905

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions e107 CMS version 3.2.1

Description e107 CMS version 3.2.1 is affected by multiple cross-site scripting (XSS) issues. A reflected XSS exists in the news comment functionality, triggered when authenticated users interact with the comment form. An attacker can inject malicious JavaScript code through a URL parameter, which executes when users click outside the comment field after typing content. Additionally, an upload restriction bypass for authenticated administrators allows the upload of SVG files containing malicious code via the media manager’s remote URL upload feature, leading to stored XSS when these files are accessed. The affected components are news.php and image.php.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, sanitize all user inputs in the comment form of the news.php component. Restrict administrator privileges to prevent unauthorized file uploads through the media manager in the image.php component.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-50905

Affected Products

E107 Cms

References · 9

• 🔥 https://exploit-db.com/exploits/50910 · Exploit
• https://osv.dev/vulnerability/CVE-2022-50905 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-50905 · Security Note
• https://vulncheck.com/advisories/e-cms-reflected-xss-via-comment-flow · Note
• https://twitter.com/CVEnew/status/2011759626610528464 · Twitter Post
• https://e107.org/download · Note
• https://t.me/cveNotify/149397 · Telegram Post
• https://t.me/cveNotify/149316 · Telegram Post
• https://e107.org · Note