Ee107inc

Products

Exploited and recent CVEs

• CVE-2026-114407 Medium 6.1 e107 CMS before 2.3.13 Reflected XSS via search.php author Parameter 0.3%
• CVE-2026-55573 Critical 9.8 e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain 0.7%
• CVE-2026-55572 Critical 10.0 e107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login username 0.5%
• CVE-2026-57859 High 7.5 e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize() 0.5%
• CVE-2026-48997 High 7.1 e107: Command Injection via shell expansion in ImageMagick resize destination path 0.9%
• CVE-2026-46620 Medium 6.5 e107: CSRF in comment.php moderation endpoints via token-optional validation in session_handler::check() 0.1%
• CVE-2026-43935 High 8.1 e107: Host Header Injection in e107 password reset enables phishing 0.3%
• CVE-2026-43934 Medium 6.5 e107: Broken Access Control in e107 comment edit allows cross-user comment modification 0.2%
• CVE-2026-43936 Medium 4.3 e107: Server-Side Request Forgery (SSRF) in the remote file fetcher 0.2%