Cross-Site Scripting Vulnerability in e107 by e107 Inc.
CVE-2018-16381

6.1MEDIUM

Key Information:

Vendor

E107

Status
E107
Vendor
CVE Published:
5 September 2018

What is CVE-2018-16381?

The e107 content management system version 2.1.8 is susceptible to a Cross-Site Scripting (XSS) vulnerability. This flaw occurs due to inadequate sanitization of user input via the 'user_loginname' parameter in the 'users.php' file. An attacker can exploit this vulnerability to inject malicious scripts that may compromise user sessions, redirect users, or perform actions on behalf of the user without consent.

References

https://github.com/dhananjay-bajaj/E107-v2.1.8-XSS-POC
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.