CVE-2016-10378: e107

High severity, CVSS 7.2. EPSS: 1.3% chance of exploitation in the next 30 days.

e107 2.1.1 allows SQL injection by remote authenticated administrators via the pagelist parameter to e107_admin/menus.php, related to the menuSaveVisibility function.

Affected products

• e107 e107: version 2.1.1 only

Published 2017-05-29. Last modified 2026-06-17.