What’s Vulnerable › Vulnerabilities

CVE-2010-2099

• Severity: high (CVSS 7.5 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2010-05-27 · updated 2026-06-16
• Weakness: CWE-264

Description

bbcode/php.bb in e107 0.7.20 and earlier does not perform access control checks for all inputs that could contain the php bbcode tag, which allows remote attackers to execute arbitrary PHP code, as demonstrated using the toEmail method in contact.php, related to invocations of the toHTML method.

Affected products

• e107 CMS: through 0.7.20; 0.6_10, 0.6_11, 0.6_12, 0.6_13, 0.6_14, 0.6_15 (+56)

References

• http://php-security.org/2010/05/19/mops-2010-035-e107-bbcode-remote-php-code-execution-vulnerability/index.html
• http://www.securityfocus.com/bid/40252
• http://php-security.org/2010/05/19/mops-2010-035-e107-bbcode-remote-php-code-execution-vulnerability/index.html
• http://www.securityfocus.com/bid/40252

Get alerted when CVE-2010-2099 or the next vulnerability affects your stack