CVE-2022-50906

MEDIUM

4.8

Beschreibung

e107 CMS 3.2.1 contains an upload restriction bypass vulnerability that allows authenticated administrators to upload malicious SVG files through the media manager. Attackers with admin privileges can exploit this vulnerability to upload SVG files with embedded cross-site scripting (XSS) payloads that can execute arbitrary scripts when viewed.

CVE Details

CVSS v3.1 Bewertung4.8

SchweregradMEDIUM

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienHIGH

BenutzerinteraktionREQUIRED

Veroffentlicht1/13/2026

Zuletzt geandert1/16/2026

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

e107:e107

Schwachen (CWE)

CWE-79

Referenzen

https://e107.org/(disclosure@vulncheck.com)

https://e107.org/download(disclosure@vulncheck.com)

https://www.exploit-db.com/exploits/50910(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/e-cms-admin-upload-restriction-bypass-stored-xss(disclosure@vulncheck.com)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.