CVE-2018-16388: e107

High severity, CVSS 7.2. EPSS: 2.2% chance of exploitation in the next 30 days.

e107_web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content type.

Affected products

• e107 e107: version 2.1.8 only

Published 2018-09-12. Last modified 2026-06-17.