CVE-2026-55572: critical vulnerability in e107inc e107
e107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login username
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 10epss 0.5%
e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php. The login() methods execute those strings with PDO::query() before effective sanitization, so an unauthenticated user can inject SQL when alt_auth is installed and either backend is configured with a live external database connection. The injection can expose or modify data available to the configured database account, and query failures can additionally disclose the generated query through the debug-message path. This issue is fixed in version 2.3.7.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
e107inc · e107Related CVEs — e107inc e107
In the same product, most dangerous first.
CVE-2026-48997HIGHe107: Command Injection via shell expansion in ImageMagick resize destination pathEPSS 0.9%CVE-2026-55573CRITICALe107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chainEPSS 0.7%CVE-2026-57859HIGHe107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize()EPSS 0.5%CVE-2026-43935HIGHe107: Host Header Injection in e107 password reset enables phishingEPSS 0.3%CVE-2026-114407MEDIUMe107 CMS before 2.3.13 Reflected XSS via search.php author ParameterEPSS 0.3%CVE-2026-43936MEDIUMe107: Server-Side Request Forgery (SSRF) in the remote file fetcherEPSS 0.2%