VIR Vulnerability Intelligence Relay

CVE-2013-7305

medium
Published 2014-01-22 · Modified 2026-04-29
💬 Discuss on Community ✚ Propose mitigation
CVSS v3
—
CVSS v4 NEW
—
not yet in upstream
VIR risk
4.3

Description

fpw.php in e107 through 1.0.4 does not check the user_ban field, which makes it easier for remote attackers to reset passwords by sending a pwsubmit request and leveraging access to the e-mail account of a banned user.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Application impact
VendorProductVersionsFixed
e107e107{"endIncluding":"1.0.4"}
e107e1070.7.0
e107e1070.7.1
e107e1070.7.2
e107e1070.7.3
e107e1070.7.4
e107e1070.7.5
e107e1070.7.6
e107e1070.7.7
e107e1070.7.8
e107e1070.7.9
e107e1070.7.10
e107e1070.7.11
e107e1070.7.12
e107e1070.7.13
e107e1070.7.14
e107e1070.7.15
e107e1070.7.16
e107e1070.7.17
e107e1070.7.18
e107e1070.7.19
e107e1070.7.20
e107e1070.7.21
e107e1070.7.22
e107e1070.7.24
e107e1070.7.26
e107e1071.0.1
e107e1071.0.2
e107e1071.0.3

References

CWEs

CWE-255

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.