CVE-2010-2099: e107

High severity, CVSS 7.5. EPSS: 4.9% chance of exploitation in the next 30 days.

bbcode/php.bb in e107 0.7.20 and earlier does not perform access control checks for all inputs that could contain the php bbcode tag, which allows remote attackers to execute arbitrary PHP code, as demonstrated using the toEmail method in contact.php, related to invocations of the toHTML method.

Affected products

• e107 e107: up to and including 0.7.20; version 0.6_10 only; version 0.6_11 only; version 0.6_12 only; version 0.6_13 only; version 0.6_14 only; …

Published 2010-05-27. Last modified 2026-06-16.