Secunia Research has discovered a vulnerability in e107, which can be exploited by malicious users to conduct script insertion attacks. Input passed via the “content_heading” parameter to 107_plugins/content/content_manager.php while creating new content is not properly sanitized before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user’s browser session in context of an affected site when the malicious data is being viewed. Successful exploitation requires authentication and that the Content Management plugin is enabled. e107 version 0.7.19 is affected.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/88648/secunia-e107cmpsi.txt
Source: https://packetstormsecurity.com/files/88648/e107-Content-Management-Plugin-Script-Insertion.html