CVE-2006-4757

Severity: medium (CVSS 4.6 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2006-09-13 · updated 2026-06-16

Description

Multiple SQL injection vulnerabilities in the admin section in e107 0.7.5 allow remote authenticated administrative users to execute arbitrary SQL commands via the (1) linkopentype, (2) linkrender, (3) link_class, and (4) link_id parameters in (a) links.php; the (5) searchquery parameter in (b) users.php; and the (6) download_category_class parameter in (c) download.php. NOTE: an e107 developer has disputed the significance of the vulnerability, stating that "If your admins are injecting you, you might want to reconsider their access."

Affected products

e107 CMS: through 0.7.5; 0.6_10, 0.6_11, 0.6_12, 0.6_13, 0.6_14, 0.6_15 (+40)

References

Get alerted when CVE-2006-4757 or the next vulnerability affects your stack