hitoshura25/cvefixes huggingface dataset:
CVE-2018-15584 (PHP, published 2019-04-26T20:29Z)
Description: value: Cross-Site Scripting (XSS) vulnerability in adm/boardgroup_form_update.php and adm/boardgroup_list_update.php in gnuboard5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/gnuboard/gnuboard5
Files changed:
adm/boardgroup_form.php
adm/boardgroup_form_update.php
adm/boardgroup_list_update.php
adm/contentform.php
adm/contentformupdate.php
adm/faqmasterform.php
adm/faqmasterformupdate.php
adm/newwinform.php
adm/newwinformupdate.php
adm/point_update.php
adm/sms_admin/num_book_update.php
adm/sms_admin/num_book_write.php
Commit message: XSS 취약점 수정


Vulnerable code:
    $gr['gr_use_access'] = 0;
$sql_common = " gr_subject = '{$_POST['gr_subject']}',
                    set gr_subject    = '{$_POST['gr_subject'][$k]}',
    $co['co_html'] = 2;
    $co['co_skin'] = 'basic';
    $co['co_mobile_skin'] = 'basic';
            <input type="text" name="nw_subject" value="<?php echo stripslashes($nw['nw_subject']) ?>" id="nw_subject" required class="frm_input required" size="80">
                nw_subject = '{$_POST['nw_subject']}',
$mb_id = $_POST['mb_id'];
$po_point = $_POST['po_point'];
$po_content = $_POST['po_content'];
    $write['bg_no'] = $bg_no;
        <td><input type="text" name="bk_name" id="bk_name" maxlength="50" value="<?php echo $write['bk_name']?>" required class="frm_input required"></td>

Fixed code:
    $gr = array('gr_use_access' => 0);
$gr_subject = isset($_POST['gr_subject']) ? strip_tags($_POST['gr_subject']) : '';

$sql_common = " gr_subject = '{$gr_subject}',
    $gr_subject = strip_tags($_POST['gr_subject'][$k]);
                    set gr_subject    = '{$gr_subject}',
    $co = array(
        'co_html' => 2,
        'co_skin' => 'basic',
        'co_mobile_skin' => 'basic'
        );
$co_subject = strip_tags($co_subject);
    $fm = array();
$fm_subject = strip_tags($fm_subject);

            <input type="text" name="nw_subject" value="<?php echo get_sanitize_input($nw['nw_subject']); ?>" id="nw_subject" required class="frm_input required" size="80">
$nw_subject = isset($_POST['nw_subject']) ? strip_tags($_POST['nw_subject']) : '';

                nw_subject = '{$nw_subject}',
$mb_id = strip_tags($_POST['mb_id']);
$po_point = strip_tags($_POST['po_point']);
$po_content = strip_tags($_POST['po_content']);
    $bk_name = strip_tags($bk_name);

    $write = array('bg_no' => (int) $bg_no);
        <td><input type="text" name="bk_name" id="bk_name" maxlength="50" value="<?php echo get_sanitize_input($write['bk_name']); ?>" required class="frm_input required"></td>
CVE-2018-15585 (PHP, published 2019-03-27T20:29Z)
Description: value: Cross-Site Scripting (XSS) vulnerability in newwinform.php in GNUBOARD5 before 5.3.1.6 allows remote attackers to inject arbitrary web script or HTML via the popup title parameter.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/gnuboard/gnuboard5
Files changed:
adm/boardgroup_form.php
adm/boardgroup_form_update.php
adm/boardgroup_list_update.php
adm/contentform.php
adm/contentformupdate.php
adm/faqmasterform.php
adm/faqmasterformupdate.php
adm/newwinform.php
adm/newwinformupdate.php
adm/point_update.php
adm/sms_admin/num_book_update.php
adm/sms_admin/num_book_write.php
Commit message: XSS 취약점 수정


Vulnerable code:
    $gr['gr_use_access'] = 0;
$sql_common = " gr_subject = '{$_POST['gr_subject']}',
                    set gr_subject    = '{$_POST['gr_subject'][$k]}',
    $co['co_html'] = 2;
    $co['co_skin'] = 'basic';
    $co['co_mobile_skin'] = 'basic';
            <input type="text" name="nw_subject" value="<?php echo stripslashes($nw['nw_subject']) ?>" id="nw_subject" required class="frm_input required" size="80">
                nw_subject = '{$_POST['nw_subject']}',
$mb_id = $_POST['mb_id'];
$po_point = $_POST['po_point'];
$po_content = $_POST['po_content'];
    $write['bg_no'] = $bg_no;
        <td><input type="text" name="bk_name" id="bk_name" maxlength="50" value="<?php echo $write['bk_name']?>" required class="frm_input required"></td>

Fixed code:
    $gr = array('gr_use_access' => 0);
$gr_subject = isset($_POST['gr_subject']) ? strip_tags($_POST['gr_subject']) : '';

$sql_common = " gr_subject = '{$gr_subject}',
    $gr_subject = strip_tags($_POST['gr_subject'][$k]);
                    set gr_subject    = '{$gr_subject}',
    $co = array(
        'co_html' => 2,
        'co_skin' => 'basic',
        'co_mobile_skin' => 'basic'
        );
$co_subject = strip_tags($co_subject);
    $fm = array();
$fm_subject = strip_tags($fm_subject);

            <input type="text" name="nw_subject" value="<?php echo get_sanitize_input($nw['nw_subject']); ?>" id="nw_subject" required class="frm_input required" size="80">
$nw_subject = isset($_POST['nw_subject']) ? strip_tags($_POST['nw_subject']) : '';

                nw_subject = '{$nw_subject}',
$mb_id = strip_tags($_POST['mb_id']);
$po_point = strip_tags($_POST['po_point']);
$po_content = strip_tags($_POST['po_content']);
    $bk_name = strip_tags($bk_name);

    $write = array('bg_no' => (int) $bg_no);
        <td><input type="text" name="bk_name" id="bk_name" maxlength="50" value="<?php echo get_sanitize_input($write['bk_name']); ?>" required class="frm_input required"></td>
CVE-2021-3831 (PHP, published 2021-12-14T11:15Z)
Description: value: gnuboard5 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/gnuboard/gnuboard5
Files changed:
bbs/memo.php
Commit message: $kind 변수를 이용한 XSS 취약점 수정 (Pocas님,211214)


Vulnerable code:
else

Fixed code:
else {
    $kind = clean_xss_tags(trim($kind));
}
CVE-2022-3963 (PHP, published 2022-11-12T22:15Z)
Description: value: A vulnerability was found in gnuboard5. It has been classified as problematic. Affected is an unknown function of the file bbs/faq.php of the component FAQ Key ID Handler. The manipulation of the argument fm_id leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 5.5.8.2.1 is able to address this issue. The name of the patch is ba062ca5b62809106d5a2f7df942ffcb44ecb5a9. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-213540.
Severity: nan (CVSS v3 base score: 5.4)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/gnuboard/gnuboard5
Files changed:
bbs/faq.php
Commit message: [KVE-2022-0981] 그누보드 Reflected XSS 취약점


Vulnerable code:

Fixed code:
    $fm_id = (int) $fm_id;
CVE-2023-41334 (Python, published 2024-03-18T19:15Z)
Description: value: Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the `TranformGraph().to_dot_graph` function. A malicious user can provide a command or a script file as a value to the `savelayout` argument, which will be placed as the first value in a list of arguments passed to `subprocess.Popen`.  Although an error will be raised, the command or script will be executed successfully. Version 5.3.3 fixes this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/astropy/astropy
Files changed:
astropy/coordinates/transformations.py
Commit message: MNT: Explicit option for savelayout in to_dot_graph


Vulnerable code:
        savelayout : str
            else:

Fixed code:
        savelayout : {"plain", "dot", "neato", "fdp", "sfdp", "circo", "twopi", "nop", "nop2", "osage", "patchwork"}
            # Options from https://graphviz.org/docs/layouts/
            elif savelayout in (
                "dot",
                "neato",
                "fdp",
                "sfdp",
                "circo",
                "twopi",
                "nop",
                "nop2",
                "osage",
                "patchwork",
            ):
            else:
                raise NotImplementedError(f'savelayout="{savelayout}" is not supported')
CVE-2021-43805 (Unknown, published 2021-12-07T18:15Z)
Description: value: Solidus is a free, open-source ecommerce platform built on Rails. Versions of Solidus prior to 3.1.4, 3.0.4, and 2.11.13 have a denial of service vulnerability that could be exploited during a guest checkout. The regular expression used to validate a guest order's email was subject to exponential backtracking through a fragment like `a.a.` Versions 3.1.4, 3.0.4, and 2.11.13 have been patched to use a different regular expression. The maintainers added a check for email addresses that are no longer valid that will print information about any affected orders that exist. If a prompt upgrade is not an option, a workaround is available. It is possible to edit the file `config/application.rb` manually (with code provided by the maintainers in the GitHub Security Advisory) to check email validity.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-1333 \u2014 Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
Repository: https://github.com/solidusio/solidus
Files changed:
Commit message: Merge pull request from GHSA-qxmr-qxh6-2cc9

Fix ReDos vulnerability on Spree::EmailValidator::EMAIL_REGEXP

Vulnerable code:

Fixed code:
CVE-2021-43846 (Unknown, published 2021-12-20T22:15Z)
Description: value: `solidus_frontend` is the cart and storefront for the Solidus e-commerce project. Versions of `solidus_frontend` prior to 3.1.5, 3.0.5, and 2.11.14 contain a cross-site request forgery (CSRF) vulnerability that allows a malicious site to add an item to the user's cart without their knowledge. Versions 3.1.5, 3.0.5, and 2.11.14 contain a patch for this issue. The patch adds CSRF token verification to the "Add to cart" action. Adding forgery protection to a form that missed it can have some side effects. Other CSRF protection strategies as well as a workaround involving modifcation to config/application.rb` are available. More details on these mitigations are available in the GitHub Security Advisory.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/solidusio/solidus
Files changed:
Commit message: Merge pull request from GHSA-h3fg-h5v3-vf8m

Protect `Spree::OrdersController#populate` against CSRF attacks

Vulnerable code:

Fixed code:
CVE-2022-31000 (Unknown, published 2022-06-01T18:15Z)
Description: value: solidus_backend is the admin interface for the Solidus e-commerce framework. Versions prior to 3.1.6, 3.0.6, and 2.11.16 contain a cross-site request forgery (CSRF) vulnerability. The vulnerability allows attackers to change the state of an order's adjustments if they hold its number, and the execution happens on a store administrator's computer. Users should upgrade to solidus_backend 3.1.6, 3.0.6, or 2.11.16 to receive a patch.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/solidusio/solidus
Files changed:
Commit message: Merge pull request from GHSA-8639-qx56-r428

Fix CSRF vulnerability that allowed (un)finalizing adjustments

Vulnerable code:

Fixed code:
CVE-2021-23418 (Python, published 2021-07-29T18:15Z)
Description: value: The package glances before 3.2.1 are vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-611 \u2014 Improper Restriction of XML External Entity Reference
The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
Repository: https://github.com/nicolargo/glances
Files changed:
README.rst
glances/compat.py
optional-requirements.txt
requirements.txt
setup.py
Commit message: Security audit - B411 #1025


Vulnerable code:
influxdb
    requires = ['psutil>=5.3.0', 'future']
        'gpu': ['py3nvml'],

Fixed code:
- ``defusedxml`` (in order to monkey path xmlrpc)
- ``future`` (for Python 2 support)
*Deprecation warning note for Python 2.x users*

Glances version 4.0 will no longer supports Python 2.x.

    # Correct issue #1025 by monkey path the xmlrpc lib
    from defusedxml.xmlrpc import monkey_patch
    monkey_patch()

    # Correct issue #1025 by monkey path the xmlrpc lib
    from defusedxml.xmlrpc import monkey_patch
    monkey_patch()

influxdb>=1.0.0
defusedxml
    requires = ['psutil>=5.3.0', 'defusedxml', 'future']
    if PY3:
        extras_require['export'].append('influxdb-client')
        extras_require['gpu'] = ['py3nvml']
CVE-2020-15164 (PHP, published 2020-08-28T17:15Z)
Description: value: in Scratch Login (MediaWiki extension) before version 1.1, any account can be logged into by using the same username with leading, trailing, or repeated underscore(s), since those are treated as whitespace and trimmed by MediaWiki. This affects all users on any wiki using this extension. Since version 1.1, comments by users whose usernames would be trimmed on MediaWiki are ignored when searching for the verification code.
Severity: MEDIUM (CVSS v3 base score: 10)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/InternationalScratchWiki/mediawiki-scratch-login
Files changed:
ScratchLogin.common.php
Commit message: Disallow MW-invalid usernames from being picked

Vulnerable code:
}

Fixed code:
		if (preg_match('/^_+|_+$|__+/', $comment['author']['username'])) return false;
}
CVE-2020-36647 (Other, published 2023-01-08T10:15Z)
Description: value: A vulnerability classified as critical has been found in YunoHost-Apps transmission_ynh. Affected is an unknown function of the file conf/nginx.conf. The manipulation leads to path traversal. The patch is identified as f136dfd44eda128129e5fd2d850a3a3c600e6a4a. It is recommended to apply a patch to fix this issue. VDB-217638 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 5.3)
Weakness: CWE-22 \u2014 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Repository: https://github.com/YunoHost-Apps/transmission_ynh
Files changed:
conf/nginx.conf
Commit message: Update nginx.conf to protect against path traversal issue

Vulnerable code:
location __PATH__/downloads {

Fixed code:
location __PATH__/downloads/ {
CVE-2014-4734 (PHP, published 2014-07-21T14:55Z)
Description: value: Cross-site scripting (XSS) vulnerability in e107_admin/db.php in e107 2.0 alpha2 and earlier allows remote attackers to inject arbitrary web script or HTML via the type parameter.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/e107inc/e107
Files changed:
e107_admin/db.php
Commit message: Sanitize some request variables


Vulnerable code:

Fixed code:
if(isset($_GET['mode']))
{
    $_GET['mode'] = preg_match('/[^\w-]/', '', $_GET['mode']);
}

if(isset($_GET['type']))
{
    $_GET['type'] = preg_replace('/[^\w-]/', '', $_GET['type']);
}
CVE-2014-9459 (PHP, published 2015-01-02T20:59Z)
Description: value: Cross-site request forgery (CSRF) vulnerability in the AdminObserver function in e107_admin/users.php in e107 2.0 alpha2 allows remote attackers to hijack the authentication of administrators for requests that add users to the administrator group via the id parameter in an admin action.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/e107inc/e107
Files changed:
e107_admin/users.php
e107_handlers/user_handler.php
Commit message: Added additional check prior to administrator status change.


Vulnerable code:
		if(!$sysuser->isAdmin())
			$sysuser->set('user_admin', 1)->save(); //"user","user_admin='1' WHERE user_id={$userid}"
			$lan = str_replace(array('--UID--', '--NAME--', '--EMAIL--'), array($sysuser->getId(), $sysuser->getName(), $sysuser->getValue('email')), USRLAN_164);
			e107::getLog()->add('USET_08', $lan, E_LOG_INFORMATIVE);
			$mes->addSuccess($lan);
		if($this->getPosted('update_admin')) e107::getUserPerms()->updatePerms($userid, $_POST['perms']);

Fixed code:
	
		if($this->getPosted('update_admin'))
		{
			 e107::getUserPerms()->updatePerms($userid, $_POST['perms']);
			 $this->redirect('list', 'main', true);
		}
		
		if(!$sysuser->isAdmin()) // Security Check Only. Admin status check is added during 'updatePerms'. 
		//	$sysuser->set('user_admin', 1)->save(); //"user","user_admin='1' WHERE user_id={$userid}"
		//	$lan = str_replace(array('--UID--', '--NAME--', '--EMAIL--'), array($sysuser->getId(), $sysuser->getName(), $sysuser->getValue('email')), USRLAN_164);
		//	e107::getLog()->add('USET_08', $lan, E_LOG_INFORMATIVE);
		//	$mes->addSuccess($lan);
			$mes->addWarning("You are about to make User #<b>".$sysuser->getId()."</b> : <b>".$sysuser->getName()."</b> (".$sysuser->getValue('email').") an <b>administrator</b>."); ///TODO LAN
			$mes->addWarning("Set the permissions and click <b>Update</b> to proceed or <b>Back</b> to abort.");
		if(!$sysuser->isAdmin())
		{
			$sysuser->set('user_admin', 1)->save();
			$lan = str_replace(array('--UID--', '--NAME--', '--EMAIL--'), array($sysuser->getId(), $sysuser->getName(), $sysuser->getValue('email')), USRLAN_164);
			e107::getLog()->add('USET_08', $lan, E_LOG_INFORMATIVE);
		}
CVE-2017-8098 (PHP, published 2017-04-24T18:59Z)
Description: value: e107 2.1.4 is vulnerable to cross-site request forgery in plugin-installing, meta-changing, and settings-changing. A malicious web page can use forged requests to make e107 download and install a plug-in provided by the attacker.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/e107inc/e107
Files changed:
e107_admin/frontpage.php
e107_admin/meta.php
e107_admin/plugin.php
e107_admin/prefs.php
Commit message: Token fixes.


Vulnerable code:
		<form method='post' action='".e_SELF."'>";


			$text .= "</div>
			e107::getRender()->tablerender(EPL_ADLAN_63.SEP.$tp->toHtml($plug_vars['@attributes']['name'], "", "defs,emotes_off, no_make_clickable"),$mes->render(). $text);

Fixed code:
if(!empty($_POST) && !isset($_POST['e-token']))
{
	$_POST['e-token'] = '';
}
		<input type='hidden' name='e-token' value='".e_TOKEN."' />
		<form method='post' action='".e_SELF."'>
		<input type='hidden' name='e-token' value='".e_TOKEN."' />
		";
if(!empty($_POST) && !isset($_POST['e-token']))
{
	$_POST['e-token'] = '';
}
			<input type='hidden' name='e-token' value='".e_TOKEN."' />
			if(empty($_POST['e-token']))
			{
				return false;
			}


			$text .= "<input type='hidden' name='e-token' value='".e_TOKEN."' /></div>
		//	e107::getRender()->tablerender(EPL_ADLAN_63.SEP.$tp->toHtml($plug_vars['@attributes']['name'], "", "defs,emotes_off, no_make_clickable"),$mes->render(). $text);
if(!empty($_POST) && !isset($_POST['e-token']))
{
	$_POST['e-token'] = '';
}
	<input type='hidden' name='e-token' value='".e_TOKEN."' />
CVE-2018-16388 (PHP, published 2018-09-12T16:29Z)
Description: value: e107_web/js/plupload/upload.php in e107 2.1.8 allows remote attackers to execute arbitrary PHP code by uploading a .php filename with the image/jpeg content type.
Severity: MEDIUM (CVSS v3 base score: 7.2)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/e107inc/e107
Files changed:
e107_web/js/plupload/upload.php
Commit message: plupload fix.


Vulnerable code:


	$fileName= 'hello.jpg';


Fixed code:

	if(e107::getFile()->isClean($filePath) !== true)
	{
		@unlink($filePath);
		die('{"jsonrpc" : "2.0", "error" : {"code": 103, "message": "Bad File Detected."}, "id" : "id"}');
	}
CVE-2021-27885 (PHP, published 2021-03-02T19:15Z)
Description: value: usersettings.php in e107 through 2.3.0 lacks a certain e_TOKEN protection mechanism.
Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/e107inc/e107
Files changed:
usersettings.php
Commit message: e_TOKEN added.


Vulnerable code:

		//$text = (is_numeric($_uid) ? $rs->form_open("post", e_SELF."?".e_QUERY, "dataform", "", " class='form-horizontal' role='form' enctype='multipart/form-data'") : $rs->form_open("post", e_SELF, "dataform", "", " class='form-horizontal' role='form' enctype='multipart/form-data'"));





Fixed code:
if(!empty($_POST) && !isset($_POST['e-token']))
{
	$_POST['e-token'] = '';
}
				<input type='hidden' name='e-token' value='".defset('e_TOKEN')."' />
				<input type='hidden' name='e-token' value='".defset('e_TOKEN')."' />