https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2022-50939.htmlhttps://patchthecve.com/cve/CVE-2022-50939.htmlWed, 17 Jun 2026 05:24:28 +0000HIGH 7.2: e107 CMS version 3.2.1 contains a critical file upload vulnerability that allows authenticated administrators to override arbitrary server files through path traversal. The vulnerability exists in the Media Manager's remote URL upload functionality (image.php) where the upload_caption parameter is nhttps://patchthecve.com/cve/CVE-2022-50916.htmlhttps://patchthecve.com/cve/CVE-2022-50916.htmlWed, 17 Jun 2026 05:24:24 +0000HIGH 7.2: e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrators to override server files through the Media Manager import functionality. Attackers can exploit the upload mechanism by manipulating the upload URL parameter to overwrite existing files like top.php ihttps://patchthecve.com/cve/CVE-2022-50907.htmlhttps://patchthecve.com/cve/CVE-2022-50907.htmlWed, 17 Jun 2026 05:24:23 +0000HIGH 7.2: e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrative users to bypass upload restrictions and execute PHP files. Attackers can upload malicious PHP files to parent directories by manipulating the upload URL parameter, enabling remote code execution throhttps://patchthecve.com/cve/CVE-2022-50906.htmlhttps://patchthecve.com/cve/CVE-2022-50906.htmlWed, 17 Jun 2026 05:24:23 +0000MEDIUM 4.8: e107 CMS 3.2.1 contains an upload restriction bypass vulnerability that allows authenticated administrators to upload malicious SVG files through the media manager. Attackers with admin privileges can exploit this vulnerability to upload SVG files with embedded cross-site scripting (XSS) payloads thhttps://patchthecve.com/cve/CVE-2022-50905.htmlhttps://patchthecve.com/cve/CVE-2022-50905.htmlWed, 17 Jun 2026 05:24:23 +0000CRITICAL 9.8: e107 CMS version 3.2.1 contains multiple vulnerabilities that allow cross-site scripting (XSS) attacks. The first vulnerability is a reflected XSS that occurs in the news comment functionality when authenticated users interact with the comment form. An attacker can inject malicious JavaScript code thttps://patchthecve.com/cve/CVE-2025-11941.htmlhttps://patchthecve.com/cve/CVE-2025-11941.htmlThu, 08 Oct 2026 22:10:00 +0000MEDIUM 5.4: A vulnerability was detected in e107 CMS up to 2.3.3. This impacts an unknown function of the file /e107_admin/image.php?mode=main&action=avatar of the component Avatar Handler. Performing manipulation of the argument multiaction[] results in path traversal. It is possible to initiate the attack remhttps://patchthecve.com/cve/CVE-2025-61505.htmlhttps://patchthecve.com/cve/CVE-2025-61505.htmlWed, 17 Jun 2026 09:50:32 +0000MEDIUM 6.5: e107 CMS thru 2.3.3 are vulnerable to insecure deserialization in the `install.php` script. The script processes user-controlled input in the `previous_steps` POST parameter using `unserialize(base64_decode())` without validation, allowing attackers to craft malicious serialized data. This could lea