What is the CVSS score of CVE-2022-50905?

CVE-2022-50905 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2022-50905?

Organizations using e107 CMS version 3.2.1 face critical risk from CVE-2022-50905, a cross-site scripting vulnerability rated CVSS 9.8.

Is there a public PoC exploit available for CVE-2022-50905?

Yes, a public proof-of-concept exploit is available for CVE-2022-50905. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2022-50905?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Verify anti-CSRF tokens and content security policies are enforced.

PHP CVE-2022-50905

CRITICAL

Cross-site Scripting (XSS) (CWE-79)

2026-01-13 disclosure@vulncheck.com

PHP XSS E107

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 21, 2026 - 15:16 vuln.today

Public exploit code

CVE Published

Jan 13, 2026 - 23:15 nvd

CRITICAL 9.8

DescriptionCVE.org

e107 CMS version 3.2.1 contains multiple vulnerabilities that allow cross-site scripting (XSS) attacks. The first vulnerability is a reflected XSS that occurs in the news comment functionality when authenticated users interact with the comment form. An attacker can inject malicious JavaScript code through the URL parameter that gets executed when users click outside the comment field after typing content. The second vulnerability involves an upload restriction bypass for authenticated administrators, allowing them to upload SVG files containing malicious code through the media manager's remote URL upload feature. This results in stored XSS when the uploaded SVG files are accessed. These vulnerabilities were discovered by Hubert Wojciechowski and affect the news.php and image.php components of the CMS.

AnalysisAI

e107 CMS 3.2.1 has multiple XSS vulnerabilities in news comments that allow executing arbitrary JavaScript. Rated CVSS 9.8 suggesting further exploitation potential beyond typical XSS. PoC available.