CVE-2010-0996

MediumCVSS 6.0/10Last modified Jun 16, 2026

Description

Unrestricted file upload vulnerability in e107 before 0.7.20 allows remote authenticated users to execute arbitrary code by uploading a .php.filetypesphp file. NOTE: the vendor disputes the significance of this issue, noting that "an odd set of preferences and a missing file" are required.

Metrics

CVSS 2.0 6.0/10AV:N/AC:M/Au:S/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://e107.org/comment.php?comment.news.864Patch, Vendor Advisory
http://e107.org/svn_changelog.php?version=0.7.20
http://secunia.com/advisories/39013Vendor Advisory
http://secunia.com/secunia_research/2010-44/Vendor Advisory
http://www.securityfocus.com/archive/1/510805/100/0/threaded
http://www.securityfocus.com/bid/39540
http://www.vupen.com/english/advisories/2010/0919Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/57932
http://e107.org/comment.php?comment.news.864Patch, Vendor Advisory
http://e107.org/svn_changelog.php?version=0.7.20
http://secunia.com/advisories/39013Vendor Advisory
http://secunia.com/secunia_research/2010-44/Vendor Advisory
http://www.securityfocus.com/archive/1/510805/100/0/threaded
http://www.securityfocus.com/bid/39540
http://www.vupen.com/english/advisories/2010/0919Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/57932

Timeline

Published: Apr 20, 2010
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2010

CVE-2010-09973.5Cross-site scripting (XSS) vulnerability in 107_plugins/content/content_manager.php in the Content Management plugin in e107 before 0.7.20, CVE-2010-099810.0Multiple stack-based buffer overflows in Free Download Manager (FDM) before 3.0.852 allow remote attackers to execute arbitrary code via vec CVE-2010-09997.1Directory traversal vulnerability in Free Download Manager (FDM) before 3.0.852 allows remote attackers to create arbitrary files via direct CVE-2010-10005.8Directory traversal vulnerability in KGet in KDE SC 4.0.0 through 4.4.3 allows remote attackers to create arbitrary files via directory trav CVE-2010-100015.5A vulnerability, which was classified as problematic, was found in Shemes GrabIt up to 1.7.2 Beta 4. This affects the component NZB Date Par CVE-2010-100026.1** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic has been found in SimpleSAMLphp simplesamlphp-module-openid. Affec CVE-2010-100039.8A vulnerability classified as critical was found in gesellix titlelink on Joomla. Affected by this vulnerability is an unknown functionality CVE-2010-100046.1A vulnerability was found in Information Cards Module on simpleSAMLphp and classified as problematic. This issue affects some unknown proces CVE-2010-100062.6A vulnerability, which was classified as problematic, was found in michaelliao jopenid. Affected is the function getAuthentication of the fi CVE-2010-100079.8** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in lierdakil click-reminder. It has been rated as critical. This issue affects the CVE-2010-100085.4** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in simplesamlphp simplesamlphp-module-openidprovider up to 0.8.x. It has been decl CVE-2010-100099.8A vulnerability was found in frioux ptome. It has been rated as critical. This issue affects some unknown processing. The manipulation leads