e107inc e107 vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Latest e107inc e107 vulnerabilities

CVE-2026-114407 — e107 CMS before 2.3.13 Reflected XSS via search.php author Parameter (CVSS 6.1)
CVE-2026-55573 — e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain (CVSS 9.8)
CVE-2026-55572 — e107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login username (CVSS 10.0)
CVE-2026-57859 — e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize() (CVSS 7.5)
CVE-2026-48997 — e107: Command Injection via shell expansion in ImageMagick resize destination path (CVSS 7.1)
CVE-2026-46620 — e107: CSRF in comment.php moderation endpoints via token-optional validation in session_handler::check() (CVSS 6.5)
CVE-2026-43936 — e107: Server-Side Request Forgery (SSRF) in the remote file fetcher (CVSS 4.3)
CVE-2026-43935 — e107: Host Header Injection in e107 password reset enables phishing (CVSS 8.1)
CVE-2026-43934 — e107: Broken Access Control in e107 comment edit allows cross-user comment modification (CVSS 6.5)