e107inc has 3 CVEs on record. 3 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 9.8 (critical), with 2 rated critical.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 9.8
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
e107inc vulnerabilities
CVEs affecting e107inc, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-114407Medium· 6.1e107 CMS before 2.3.13 Reflected XSS via search.php author Parameter
e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML by manipulating the author GET parameter in search.php, which is parsed with parse_str() and co…
CVE-2026-55573Critical· 9.8PoCe107 is a content management system (CMS)
e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting …
CVE-2026-55572Critical· 10.0e107 is a content management system (CMS)
e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and …