CVE-2013-7305

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

fpw.php in e107 through 1.0.4 does not check the user_ban field, which makes it easier for remote attackers to reset passwords by sending a pwsubmit request and leveraging access to the e-mail account of a banned user.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-255

Affected software

No affected versions have been published.

Timeline

Published
Jan 22, 2014
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2013

CVE-2013-73065.4The OSPF implementation on Brocade routers does not consider the possibility of duplicate Link State ID values in Link State Advertisement (CVE-2013-73075.4The OSPF implementation on the Brocade Vyatta vRouter with software before 6.6R1 does not consider the possibility of duplicate Link State ICVE-2013-73085.4The OSPF implementation on the D-Link DES-3810-28 switch with firmware R2.20.B017 does not consider the possibility of duplicate Link State CVE-2013-73095.4The OSPF implementation in Extreme Networks EXOS does not consider the possibility of duplicate Link State ID values in Link State AdvertiseCVE-2013-73105.4The OSPF implementation on Yamaha routers does not consider the possibility of duplicate Link State ID values in Link State Advertisement (LCVE-2013-73115.4The OSPF implementation in Check Point Gaia OS R75.X and R76 and IPSO OS 6.2 R75.X and R76 does not consider the possibility of duplicate LiCVE-2013-73125.4The OSPF implementation on Enterasys switches and routers does not consider the possibility of duplicate Link State ID values in Link State CVE-2013-73135.4The OSPF implementation in Juniper Junos through 13.x, JunosE, and ScreenOS through 6.3.x does not consider the possibility of duplicate LinCVE-2013-73146.8The OSPF implementation on NEC IP38X, IX1000, IX2000, and IX3000 routers does not consider the possibility of duplicate Link State ID valuesCVE-2013-73156.8The Spring MVC in Spring Framework before 3.2.4 and 4.0.0.M1 through 4.0.0.M2 does not disable external entity resolution for the StAX XMLInCVE-2013-73164.3Cross-site scripting (XSS) vulnerability in GitLab 6.0 and other versions before 6.5.0 allows remote attackers to inject arbitrary web scripCVE-2013-73174.3Multiple cross-site scripting (XSS) vulnerabilities in CS-Cart before 4.1.1 allow remote attackers to inject arbitrary web script or HTML vi