CVE-2016-10753

e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC.

• CWE-502

• https://blog.ripstech.com/2016/e107-sql-injection-through-object-injection/Exploit, Third Party Advisory
• https://demo.ripstech.com/projects/e107_2.1.2Third Party Advisory
• https://blog.ripstech.com/2016/e107-sql-injection-through-object-injection/Exploit, Third Party Advisory
• https://demo.ripstech.com/projects/e107_2.1.2Third Party Advisory

Published

May 24, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-10746libvirt-domain.c in libvirt before 1.3.1 supports virDomainG…
• CVE-2016-10749parse_string in cJSON.c in cJSON before 2016-10-02 has a buf…9.8
• CVE-2016-1075Use-after-free vulnerability in Adobe Reader and Acrobat bef…
• CVE-2016-10750In Hazelcast before 3.11, the cluster join procedure is vuln…
• CVE-2016-10751osClass 3.6.1 allows oc-admin/plugins.php Directory Traversa…
• CVE-2016-10752serendipity_moveMediaDirectory in Serendipity 2.0.3 allows r…
• CVE-2016-10754modules/Calendar/Activity.php in Vtiger CRM 6.5.0 allows SQL…
• CVE-2016-10755AbanteCart 1.2.8 allows SQL Injection via the source_languag…
• CVE-2016-10756Kliqqi 3.0.0.5 allows CSRF with resultant Arbitrary File Upl…
• CVE-2016-10757In Redaxo 5.2.0, the cron management of the admin panel suff…
• CVE-2016-10758PHPKIT 1.6.6 allows arbitrary File Upload, as demonstrated b…
• CVE-2016-10759The Xinha plugin in Precurio 2.1 allows Directory Traversal,…