CVE-2026-114407: falha de média gravidade em e107inc e107
e107 CMS before 2.3.13 Reflected XSS via search.php author Parameter
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.1epss 0.3%
e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML by manipulating the author GET parameter in search.php, which is parsed with parse_str() and concatenated unescaped into a rendered input tag via the form handler's 'other' option key. Attackers can craft a single GET request containing a crafted author parameter to break out of the HTML input tag and inject an img element with an onerror handler, executing arbitrary JavaScript in the victim's browser session.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Produtos afetados
e107inc · e107CVEs relacionadas — e107inc e107
No mesmo produto, das mais perigosas para as menos.
CVE-2026-48997HIGHe107: Command Injection via shell expansion in ImageMagick resize destination pathEPSS 0.9%CVE-2026-55573CRITICALe107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chainEPSS 0.7%CVE-2026-55572CRITICALe107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login usernameEPSS 0.5%CVE-2026-57859HIGHe107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize()EPSS 0.5%CVE-2026-43935HIGHe107: Host Header Injection in e107 password reset enables phishingEPSS 0.3%CVE-2026-43936MEDIUMe107: Server-Side Request Forgery (SSRF) in the remote file fetcherEPSS 0.2%