Description
e107 2.1.2 allows PHP Object Injection with resultant SQL injection, because usersettings.php uses unserialize without an HMAC.
Remediation
References
Related Vulnerabilities
Piwigo Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2018-7724)
WordPress Plugin MW WP Form Cross-Site Scripting (2.10.0)
Oracle JRE CVE-2013-0443 Vulnerability (CVE-2013-0443)
WordPress Plugin SB Welcome Email Editor Unspecified Vulnerability (4.1)
OpenSSL NULL Pointer Dereference Vulnerability (CVE-2006-4343)