Cross-Site Scripting Vulnerabilities in e107 CMS by e107
CVE-2022-50905

5.1MEDIUM

Key Information:

Vendor

E107

Status
E107 Cms
Vendor
CVE Published:
13 January 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2022-50905?

e107 CMS version 3.2.1 is vulnerable to multiple cross-site scripting (XSS) flaws. The first flaw allows attackers to perform reflected XSS attacks via the news comment functionality, where malicious JavaScript can be injected using URL parameters. When authenticated users engage with the comment form, the payload executes upon interaction outside the comment field. The second vulnerability permits authenticated administrators to bypass file upload restrictions, enabling the upload of SVG files that can contain harmful scripts. Accessing these uploaded SVG files leads to stored XSS attacks. These vulnerabilities could significantly compromise the security of websites using this version of e107 CMS.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

e107 CMS 3.2.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2022-50905 - Proof of Concept

References

https://www.exploit-db.com/exploits/50910
exploit
https://e107.org/
product
https://e107.org/download
product

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Hubert Wojciechowski
JSON
.