Vulnerabilities

TI-2026-78761 CVE-2026-114407 · GHSA-26h5-jjjv-6774

e107 CMS Reflected XSS via search.php author Parameter

LOW 23

e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML by manipulating the author GET parameter in search.php, which is parsed with p…

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00276 Published 2026-10-21 Fixed in 2.3.13 CWE-79

TI-2026-74376 CVE-2026-55573

Unsafe deserialization in e107 installer enables remote code execution

HIGH 82

e107 is a content management system (CMS).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00704 Published 2026-10-14 Fixed in 2.3.7 CWE-502

TI-2026-74375 CVE-2026-55572

SQL injection in e107 alt_auth plugin via login username

MEDIUM 49

e107 is a content management system (CMS).

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00515 Published 2026-10-14 Fixed in 2.3.7 CWE-89

TI-2026-41663 CVE-2026-57859

e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize()

HIGH 69

e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted…

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00512 Published 2026-07-30 Fixed in 2.3.8 CWE-502

TI-2026-36251 CVE-2026-48997

e107: Command Injection via shell expansion in ImageMagick resize destination path

MEDIUM 64

e107 is a content management system (CMS).

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00946 Published 2026-06-17 Fixed in 2.3.6 CWE-78

TI-2026-34276 CVE-2026-46620

e107: CSRF in comment.php moderation endpoints via token-optional validation in session_handler::check()

MEDIUM 62

e107 is a content management system (CMS).

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00133 Published 2026-05-26 Fixed in 2.3.5 CWE-285

TI-2026-31992 CVE-2026-43935

e107: Host Header Injection in e107 password reset enables phishing

HIGH 70

e107 is a content management system (CMS).

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00297 Published 2026-05-26 Fixed in 2.3.4 CWE-20

TI-2026-31991 CVE-2026-43934

e107: Broken Access Control in e107 comment edit allows cross-user comment modification

MEDIUM 62

e107 is a content management system (CMS).

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00181 Published 2026-05-26 Fixed in 2.3.4 CWE-284

TI-2026-31993 CVE-2026-43936

e107: Server-Side Request Forgery (SSRF) in the remote file fetcher

MEDIUM 53

e107 is a content management system (CMS).

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00193 Published 2026-05-26 Fixed in 2.3.4 CWE-918

Vulnerabilities

Filters