What’s Vulnerable › Vulnerabilities

CVE-2026-114407: e107 CMS before 2.3.13 Reflected XSS via search.php author Parameter

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-21 · updated 2026-10-23
• Weakness: CWE-79

Description

e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML by manipulating the author GET parameter in search.php, which is parsed with parse_str() and concatenated unescaped into a rendered input tag via the form handler's 'other' option key. Attackers can craft a single GET request containing a crafted author parameter to break out of the HTML input tag and inject an img element with an onerror handler, executing arbitrary JavaScript in the victim's browser session.

Affected products

• e107inc e107: from 2.2.0 before 2.3.13 — fixed in 2.3.13

How to fix

Upgrade to a fixed version: e107inc e107 2.3.13. Check the vendor advisory for mitigations.

References

• https://github.com/e107inc/e107/releases/tag/v2.3.13
• https://github.com/e107inc/e107/security/advisories/GHSA-g7rc-4jvq-27m9
• https://www.vulncheck.com/advisories/e107-cms-before-reflected-xss-via-search-php-author-parameter

Get alerted when CVE-2026-114407 or the next vulnerability affects your stack