CVE Feed

    Dashboard / CVE / CVE-2021-47937

    CVE-2021-47937

    e107 CMS 2.3.0 contains a remote code execution vulnerability that allows authenticated users with theme installation permissions to execute arbitrary commands by uploading malicious theme files. Attackers can upload a crafted theme package through the theme.php endpoint that deploys a web shell to the e107_themes directory, then execute system commands via the payload.php script.

    Published:May 10, 2026
    Last Modified:May 12, 2026
    EPS:May 10, 2026
    EPSS Score:0.00265
    CVSS Score:8.8

    Affected Products

    Vendor
    E107
    Product
    E107 Cms

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs

    Related CVEs

    CVE-2022-50939 (CVSS 8.6) — e107 CMS version 3.2.1 contains a critical file upload vulnerability that allows authenticated administrators …
    CVE-2022-50916 (CVSS 8.7) — e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrators to overri…
    CVE-2022-50907 (CVSS 8.6) — e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrative users to …
    CVE-2022-50906 (CVSS 4.8) — e107 CMS 3.2.1 contains an upload restriction bypass vulnerability that allows authenticated administrators to…
    CVE-2022-50905 (CVSS 9.8) — e107 CMS version 3.2.1 contains multiple vulnerabilities that allow cross-site scripting (XSS) attacks. The fi…
    CVE-2025-11941 (CVSS 2.1) — A vulnerability was detected in e107 CMS up to 2.3.3. This impacts an unknown function of the file /e107_admin…
    CVE-2023-43873 (CVSS 5.4) — A Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary co…
    CVE-2023-43874 (CVSS 5.4) — Multiple Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbit…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High