CVE-2010-2099

CVE-2010-2099 describes a critical access control vulnerability in e107 versions 0.7.20 and earlier, specifically within the bbcode/php.bb component. This flaw allows remote attackers to execute arbitrary PHP code due to insufficient access control checks on inputs containing the php bbcode tag, as demonstrated through the toEmail method in contact.php. With a CVSS score of 7.5, this vulnerability is easily exploitable over the network with low complexity and no authentication, potentially leading to partial compromise of confidentiality, integrity, and availability. While not listed on the KEV catalog or Hot List, an exploit (EDB-12715) is publicly available, though there is no evidence of active exploitation or significant community discussion.