CVE-2004-2040: e107

Medium severity, CVSS 4.3. EPSS: 5.1% chance of exploitation in the next 30 days.

Multiple cross-site scripting (XSS) vulnerabilities in e107 0.615 allow remote attackers to inject arbitrary web script or HTML via the (1) LAN_407 parameter to clock_menu.php, (2) "email article to a friend" field, (3) "submit news" field, or (4) avmsg parameter to usersettings.php.

Affected products

• e107 e107: version 0.6_15 only; version 0.6_15a only

Published 2004-05-29. Last modified 2026-06-16.