E107inc E107 vulnerabilities

• e107inc e107 e107 CMS before 2.3.13 Reflected XSS via search.php author Parameter CVE-2026-114407 5.1 MediumOctober 21, 2026
• e107inc e107 e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain CVE-2026-55573 9.8 CriticalOctober 14, 2026
• e107inc e107 e107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login username CVE-2026-55572 10.0 CriticalOctober 14, 2026
• e107 e107 e107 - SQL Injection CVE-2026-72599 9.8 CriticalAugust 11, 2026
• e107inc e107 e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize() CVE-2026-57859 7.7 HighJuly 30, 2026
• e107inc e107 e107: Command Injection via shell expansion in ImageMagick resize destination path CVE-2026-48997 7.1 HighJune 17, 2026
• e107inc e107 e107: CSRF in comment.php moderation endpoints via token-optional validation in session_handler::check() CVE-2026-46620 6.5 MediumMay 26, 2026
• e107inc e107 e107: Host Header Injection in e107 password reset enables phishing CVE-2026-43935 8.1 HighMay 26, 2026
• e107inc e107 e107: Broken Access Control in e107 comment edit allows cross-user comment modification CVE-2026-43934 6.5 MediumMay 26, 2026
• e107inc e107 e107: Server-Side Request Forgery (SSRF) in the remote file fetcher CVE-2026-43936 4.3 MediumMay 26, 2026