Vulnerability record · CVE-2004-2262 · published 31 December 2004

CVE-2004-2262: E107 unrestricted file upload vulnerability

E107 · E107

ImageManager in e107 before 0.617 does not properly check the types of uploaded files, which allows remote attackers to execute arbitrary code by uploading a PHP file via the upload parameter to images.php.

7.5 CVSS 2.0 High EPSS 15% · top 3.4% CWE-434 · Unrestricted file upload

7.5CVSS 2.0 base score

15%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

14References, 2 tagged exploit

16 Jun 2026Last modified by NVD

Description

AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

E107 E107

References

Link	Tags
http://e107.org/comment.php?comment.news.672	Broken LinkPatch
http://secunia.com/advisories/13657	Broken LinkVendor Advisory
http://securitytracker.com/id?1012657	Broken LinkExploitThird Party AdvisoryVDB Entry
http://www.osvdb.org/12586	Broken Link
http://www.securityfocus.com/bid/12111	Broken LinkThird Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/18670	Third Party AdvisoryVDB Entry
https://www.exploit-db.com/exploits/704	Third Party AdvisoryVDB Entry
http://e107.org/comment.php?comment.news.672	Broken LinkPatch
http://secunia.com/advisories/13657	Broken LinkVendor Advisory
http://securitytracker.com/id?1012657	Broken LinkExploitThird Party AdvisoryVDB Entry
http://www.osvdb.org/12586	Broken Link
http://www.securityfocus.com/bid/12111	Broken LinkThird Party AdvisoryVDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/18670	Third Party AdvisoryVDB Entry
https://www.exploit-db.com/exploits/704	Third Party AdvisoryVDB Entry

Track CVE-2004-2262 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2008-1989123flashchat 123 flash chat module code injection vulnerabilityPHP remote file inclusion vulnerability in 123flashchat.php in the 123 Flash Chat 6.8.0 module for e107, when register_globals is enabled, allows rem…EPSS 3.6%27 Apr 2008 8.8CVE-2021-27885E107 cross-site request forgery vulnerabilityusersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism.EPSS 3.2%2 Mar 2021 8.8CVE-2016-10753E107 deserialization of untrusted data vulnerabilitye107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC.EPSS 1.7%24 May 2019 8.8CVE-2018-15901E107 cross-site request forgery vulnerabilitye107 2.1.8 has CSRF in 'usersettings.php' with an impact of changing details such as passwords of users including administrators.EPSS 0.56%28 Aug 2018 8.7CVE-2022-50916E107 unrestricted file upload vulnerabilitye107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrators to override server files through the Media Manag…EPSS 0.93%13 Jan 2026 8.6CVE-2022-50939E107 path traversal vulnerabilitye107 CMS version 3.2.1 contains a critical file upload vulnerability that allows authenticated administrators to override arbitrary server files thro…EPSS 1.3%13 Jan 2026 8.6CVE-2022-50907E107 unrestricted file upload vulnerabilitye107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrative users to bypass upload restrictions and execute …EPSS 1.2%13 Jan 2026 7.5CVE-2011-1513E107 os command injection vulnerabilityStatic code injection vulnerability in install_.php in e107 CMS 0.7.24 and probably earlier versions, when the installation script is not removed, al…EPSS 5.6%4 Nov 2011

Source: NIST National Vulnerability Database (record CVE-2004-2262), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.