Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-55573 (GCVE-0-2026-55573)

Vulnerability from nvd – Published: 2026-10-14 18:12 – Updated: 2026-10-15 15:01

Title

e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain

Summary

e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting allowed classes. The installer remains accessible after a normal installation, and a crafted object graph using the bundled GuzzleHttp\Psr7\PumpStream class can flow through paths.hash into site_path, where string coercion invokes an attacker-controlled callable. An unauthenticated attacker who can reach install.php can therefore execute arbitrary PHP functions with the web server process's privileges, leading to full server compromise. This issue is fixed in version 2.3.7.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 15:00 UTC

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7712 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/e107inc/e107/security/advisori…	x_refsource_CONFIRM
https://github.com/e107inc/e107/commit/5d6d649e8c…	x_refsource_MISC
https://github.com/e107inc/e107/commit/6c40429521…	x_refsource_MISC
https://github.com/e107inc/e107/releases/tag/v2.3.7	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
e107inc	e107	Affected: < 2.3.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55573",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T15:00:08.038362Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T15:01:54.402Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/e107inc/e107/security/advisories/GHSA-c8h6-wpj3-4cr8"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "e107",
          "vendor": "e107inc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.3.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting allowed classes. The installer remains accessible after a normal installation, and a crafted object graph using the bundled GuzzleHttp\\Psr7\\PumpStream class can flow through paths.hash into site_path, where string coercion invokes an attacker-controlled callable. An unauthenticated attacker who can reach install.php can therefore execute arbitrary PHP functions with the web server process\u0027s privileges, leading to full server compromise. This issue is fixed in version 2.3.7."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T18:12:58.640Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/e107inc/e107/security/advisories/GHSA-c8h6-wpj3-4cr8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/e107inc/e107/security/advisories/GHSA-c8h6-wpj3-4cr8"
        },
        {
          "name": "https://github.com/e107inc/e107/commit/5d6d649e8cf01854d6024d07997c2449fdd75f24",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/e107inc/e107/commit/5d6d649e8cf01854d6024d07997c2449fdd75f24"
        },
        {
          "name": "https://github.com/e107inc/e107/commit/6c404295213952aedb9b3689be19dd4c7ba550b0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/e107inc/e107/commit/6c404295213952aedb9b3689be19dd4c7ba550b0"
        },
        {
          "name": "https://github.com/e107inc/e107/releases/tag/v2.3.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/e107inc/e107/releases/tag/v2.3.7"
        }
      ],
      "source": {
        "advisory": "GHSA-c8h6-wpj3-4cr8",
        "discovery": "UNKNOWN"
      },
      "title": "e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55573",
    "datePublished": "2026-10-14T18:12:58.640Z",
    "dateReserved": "2026-06-16T23:11:20.214Z",
    "dateUpdated": "2026-10-15T15:01:54.402Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55572 (GCVE-0-2026-55572)

Vulnerability from nvd – Published: 2026-10-14 18:12 – Updated: 2026-10-14 18:12

Title

e107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login username

Summary

e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php. The login() methods execute those strings with PDO::query() before effective sanitization, so an unauthenticated user can inject SQL when alt_auth is installed and either backend is configured with a live external database connection. The injection can expose or modify data available to the configured database account, and query failures can additionally disclose the generated query through the debug-message path. This issue is fixed in version 2.3.7.

Severity

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7712 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/e107inc/e107/security/advisori…	x_refsource_CONFIRM
https://github.com/e107inc/e107/commit/120bd4bdbe…	x_refsource_MISC
https://github.com/e107inc/e107/releases/tag/v2.3.7	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
e107inc	e107	Affected: < 2.3.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "e107",
          "vendor": "e107inc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.3.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin\u0027s otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php. The login() methods execute those strings with PDO::query() before effective sanitization, so an unauthenticated user can inject SQL when alt_auth is installed and either backend is configured with a live external database connection. The injection can expose or modify data available to the configured database account, and query failures can additionally disclose the generated query through the debug-message path. This issue is fixed in version 2.3.7."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T18:12:10.984Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/e107inc/e107/security/advisories/GHSA-5f75-c25x-59wx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/e107inc/e107/security/advisories/GHSA-5f75-c25x-59wx"
        },
        {
          "name": "https://github.com/e107inc/e107/commit/120bd4bdbe18c8690c60a007ad6716e52e6ee965",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/e107inc/e107/commit/120bd4bdbe18c8690c60a007ad6716e52e6ee965"
        },
        {
          "name": "https://github.com/e107inc/e107/releases/tag/v2.3.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/e107inc/e107/releases/tag/v2.3.7"
        }
      ],
      "source": {
        "advisory": "GHSA-5f75-c25x-59wx",
        "discovery": "UNKNOWN"
      },
      "title": "e107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login username"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55572",
    "datePublished": "2026-10-14T18:12:10.984Z",
    "dateReserved": "2026-06-16T23:11:20.214Z",
    "dateUpdated": "2026-10-14T18:12:10.984Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-57859 (GCVE-0-2026-57859)

Vulnerability from nvd – Published: 2026-07-30 13:41 – Updated: 2026-08-14 16:50

Title

e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize()

Summary

e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the user_prefs column. The e_array::unserialize() function in e107_handlers/core_functions.php performs only a prefix check for the string 'array' before passing the stored value to eval(), causing automatic PHP execution whenever the affected user's preferences are materialized through e_user_pref::load().

Severity

7.7 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-30 14:25 UTC

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6248 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/e107inc/e107/security/advisori…	vendor-advisory
https://github.com/e107inc/e107/commit/40e73cefde…	patch
https://github.com/e107inc/e107	technical-description
https://www.vulncheck.com/advisories/e107-second-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
e107inc	e107	Affected: 0 , ≤ 2.3.7 (semver) Unaffected: 2.3.8 (semver) cpe:2.3:a:e107:e107::::::::

Date Public

2026-07-30 00:00

Credits

Usmon Khudoyorov

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-57859",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-30T14:25:32.307197Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-30T14:25:51.954Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/e107inc/e107/security/advisories/GHSA-568x-w5qj-vr7c"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "e107",
          "vendor": "e107inc",
          "versions": [
            {
              "lessThanOrEqual": "2.3.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.3.8",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:e107:e107:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "2.3.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Usmon Khudoyorov"
        }
      ],
      "datePublic": "2026-07-30T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the user_prefs column. The e_array::unserialize() function in e107_handlers/core_functions.php performs only a prefix check for the string \u0027array\u0027 before passing the stored value to eval(), causing automatic PHP execution whenever the affected user\u0027s preferences are materialized through e_user_pref::load()."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-14T16:50:24.335Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-568x-w5qj-vr7c)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/e107inc/e107/security/advisories/GHSA-568x-w5qj-vr7c"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/e107inc/e107/commit/40e73cefde85b32e1227dfac9956a5cb87046277"
        },
        {
          "name": "Product Repository",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/e107inc/e107"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/e107-second-order-code-execution-via-eval-based-deserialization-in-e-array-unserialize"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize()",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-57859",
    "datePublished": "2026-07-30T13:41:34.196Z",
    "dateReserved": "2026-06-25T18:48:00.283Z",
    "dateUpdated": "2026-08-14T16:50:24.335Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48997 (GCVE-0-2026-48997)

Vulnerability from nvd – Published: 2026-06-17 21:42 – Updated: 2026-06-18 13:06

Title

e107: Command Injection via shell expansion in ImageMagick resize destination path

Summary

e107 is a content management system (CMS). Versions 2.3.5 and earlier contain a command injection vulnerability in the ImageMagick resize destination path. In resize_image(), the source path is escaped with escapeshellarg(), but the destination path is inserted inside raw double quotes in the convert command; in the submit-news upload flow, that destination filename includes the first six characters of user-controlled news title input. Because the title filter removes literal spaces but not tab characters, and shell expansions such as $(...) and backticks can survive into the quoted destination argument, /bin/sh -c may evaluate attacker-controlled input. Exploitation is possible only when all of the following non-default settings are enabled: resize_method=ImageMagick, subnews_attach=1, upload_enabled=1, subnews_resize is numeric between 30 and 5000, and the attacker is a non-admin in classes permitted by both subnews_class and upload_class. This issue has been fixed in version 2.3.6.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-18 13:05 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7712 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/e107inc/e107/security/advisori…	x_refsource_CONFIRM
https://github.com/e107inc/e107/releases/tag/v2.3.6	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
e107inc	e107	Affected: < 2.3.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48997",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-18T13:05:40.518821Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-18T13:06:02.489Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/e107inc/e107/security/advisories/GHSA-3j33-c9v4-4p42"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "e107",
          "vendor": "e107inc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.3.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "e107 is a content management system (CMS). Versions  2.3.5 and earlier contain a command injection vulnerability in the ImageMagick resize destination path. In resize_image(), the source path is escaped with escapeshellarg(), but the destination path is inserted inside raw double quotes in the convert command; in the submit-news upload flow, that destination filename includes the first six characters of user-controlled news title input. Because the title filter removes literal spaces but not tab characters, and shell expansions such as $(...) and backticks can survive into the quoted destination argument, /bin/sh -c may evaluate attacker-controlled input. Exploitation is possible only when all of the following non-default settings are enabled: resize_method=ImageMagick, subnews_attach=1, upload_enabled=1, subnews_resize is numeric between 30 and 5000, and the attacker is a non-admin in classes permitted by both subnews_class and upload_class. This issue has been fixed in version 2.3.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-17T21:42:59.679Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/e107inc/e107/security/advisories/GHSA-3j33-c9v4-4p42",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/e107inc/e107/security/advisories/GHSA-3j33-c9v4-4p42"
        },
        {
          "name": "https://github.com/e107inc/e107/releases/tag/v2.3.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/e107inc/e107/releases/tag/v2.3.6"
        }
      ],
      "source": {
        "advisory": "GHSA-3j33-c9v4-4p42",
        "discovery": "UNKNOWN"
      },
      "title": "e107: Command Injection via shell expansion in ImageMagick resize destination path"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48997",
    "datePublished": "2026-06-17T21:42:59.679Z",
    "dateReserved": "2026-05-26T23:26:07.976Z",
    "dateUpdated": "2026-06-18T13:06:02.489Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46620 (GCVE-0-2026-46620)

Vulnerability from nvd – Published: 2026-05-26 15:04 – Updated: 2026-05-27 16:04

Title

e107: CSRF in comment.php moderation endpoints via token-optional validation in session_handler::check()

Summary

e107 is a content management system (CMS). Prior to 2.3.5, e107 CMS does not properly enforce CSRF token validation on comment moderation actions. The problem comes down to how session_handler::check() handles CSRF tokens. Instead of requiring a token on every state-changing request, it only validates the token if one happens to be present. If there is no token at all, the check is skipped entirely. This vulnerability is fixed in 2.3.5.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-27 16:04 UTC

CWE

CWE-285 - Improper Authorization
CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7712 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/e107inc/e107/security/advisori…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
e107inc	e107	Affected: < 2.3.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-46620",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-27T16:04:28.086263Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-27T16:04:41.864Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/e107inc/e107/security/advisories/GHSA-m4hh-m278-jwg5"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "e107",
          "vendor": "e107inc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.3.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "e107 is a content management system (CMS). Prior to 2.3.5, e107 CMS does not properly enforce CSRF token validation on comment moderation actions. The problem comes down to how session_handler::check() handles CSRF tokens. Instead of requiring a token on every state-changing request, it only validates the token if one happens to be present. If there is no token at all, the check is skipped entirely. This vulnerability is fixed in 2.3.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-26T15:04:32.092Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/e107inc/e107/security/advisories/GHSA-m4hh-m278-jwg5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/e107inc/e107/security/advisories/GHSA-m4hh-m278-jwg5"
        }
      ],
      "source": {
        "advisory": "GHSA-m4hh-m278-jwg5",
        "discovery": "UNKNOWN"
      },
      "title": "e107: CSRF in comment.php moderation endpoints via token-optional validation in session_handler::check()"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-46620",
    "datePublished": "2026-05-26T15:04:32.092Z",
    "dateReserved": "2026-05-15T19:34:14.012Z",
    "dateUpdated": "2026-05-27T16:04:41.864Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43936 (GCVE-0-2026-43936)

Vulnerability from nvd – Published: 2026-05-26 14:51 – Updated: 2026-05-26 16:21

Title

e107: Server-Side Request Forgery (SSRF) in the remote file fetcher

Summary

e107 is a content management system (CMS). Prior to 2.3.4, you can access the local environment by specifying the URL of the local environment from "Image/File URL:" of "From a remote location" in "Media Manager" on the administrator screen. This vulnerability is fixed in 2.3.4.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-26 16:20 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7712 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/e107inc/e107/security/advisori…	x_refsource_CONFIRM
https://github.com/e107inc/e107/commit/40b2d111	x_refsource_MISC
https://github.com/e107inc/e107/commit/5f98cc9f	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
e107inc	e107	Affected: < 2.3.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-43936",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-26T16:20:54.858253Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-26T16:21:18.449Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/e107inc/e107/security/advisories/GHSA-92fr-7h4f-22pp"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "e107",
          "vendor": "e107inc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.3.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "e107 is a content management system (CMS). Prior to 2.3.4, you can access the local environment by specifying the URL of the local environment from \"Image/File URL:\" of \"From a remote location\" in \"Media Manager\" on the administrator screen. This vulnerability is fixed in 2.3.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-26T14:51:49.317Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/e107inc/e107/security/advisories/GHSA-92fr-7h4f-22pp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/e107inc/e107/security/advisories/GHSA-92fr-7h4f-22pp"
        },
        {
          "name": "https://github.com/e107inc/e107/commit/40b2d111",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/e107inc/e107/commit/40b2d111"
        },
        {
          "name": "https://github.com/e107inc/e107/commit/5f98cc9f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/e107inc/e107/commit/5f98cc9f"
        }
      ],
      "source": {
        "advisory": "GHSA-92fr-7h4f-22pp",
        "discovery": "UNKNOWN"
      },
      "title": "e107: Server-Side Request Forgery (SSRF) in the remote file fetcher"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-43936",
    "datePublished": "2026-05-26T14:51:49.317Z",
    "dateReserved": "2026-05-04T16:59:09.089Z",
    "dateUpdated": "2026-05-26T16:21:18.449Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43935 (GCVE-0-2026-43935)

Vulnerability from nvd – Published: 2026-05-26 15:01 – Updated: 2026-05-26 15:49

Title

e107: Host Header Injection in e107 password reset enables phishing

Summary

e107 is a content management system (CMS). Prior to 2.3.4, a Host Header Injection vulnerability in the password reset page allows attackers to manipulate the Host header to generate password reset links pointing to attacker-controlled domains. This can lead to phishing attacks, account takeover, or other security risks. The severity is high, as the vulnerability affects a critical function related to user authentication. This vulnerability is fixed in 2.3.4.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-26 15:49 UTC

CWE

CWE-20 - Improper Input Validation
CWE-807 - Reliance on Untrusted Inputs in a Security Decision

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7712 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/e107inc/e107/security/advisori…	x_refsource_CONFIRM
https://github.com/e107inc/e107/commit/04511f9f1d…	x_refsource_MISC
https://github.com/e107inc/e107/commit/b0dee8234e…	x_refsource_MISC
https://github.com/e107inc/e107/commit/c4f9f71b0f…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
e107inc	e107	Affected: < 2.3.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-43935",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-26T15:49:32.402267Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-26T15:49:36.185Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/e107inc/e107/security/advisories/GHSA-7pmw-jwvr-cq2x"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "e107",
          "vendor": "e107inc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.3.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "e107 is a content management system (CMS). Prior to 2.3.4, a Host Header Injection vulnerability in the password reset page allows attackers to manipulate the Host header to generate password reset links pointing to attacker-controlled domains. This can lead to phishing attacks, account takeover, or other security risks. The severity is high, as the vulnerability affects a critical function related to user authentication. This vulnerability is fixed in 2.3.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-807",
              "description": "CWE-807: Reliance on Untrusted Inputs in a Security Decision",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-26T15:01:36.720Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/e107inc/e107/security/advisories/GHSA-7pmw-jwvr-cq2x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/e107inc/e107/security/advisories/GHSA-7pmw-jwvr-cq2x"
        },
        {
          "name": "https://github.com/e107inc/e107/commit/04511f9f1d6e97c31ba7cc5bf7f1f9a19d221db6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/e107inc/e107/commit/04511f9f1d6e97c31ba7cc5bf7f1f9a19d221db6"
        },
        {
          "name": "https://github.com/e107inc/e107/commit/b0dee8234e273debbf7a8ae054de464f1008f357",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/e107inc/e107/commit/b0dee8234e273debbf7a8ae054de464f1008f357"
        },
        {
          "name": "https://github.com/e107inc/e107/commit/c4f9f71b0fd695545d0f09e2277b6f70ff4660fc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/e107inc/e107/commit/c4f9f71b0fd695545d0f09e2277b6f70ff4660fc"
        }
      ],
      "source": {
        "advisory": "GHSA-7pmw-jwvr-cq2x",
        "discovery": "UNKNOWN"
      },
      "title": "e107: Host Header Injection in e107 password reset enables phishing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-43935",
    "datePublished": "2026-05-26T15:01:36.720Z",
    "dateReserved": "2026-05-04T16:59:09.089Z",
    "dateUpdated": "2026-05-26T15:49:36.185Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43934 (GCVE-0-2026-43934)

Vulnerability from nvd – Published: 2026-05-26 14:54 – Updated: 2026-05-26 17:40

Title

e107: Broken Access Control in e107 comment edit allows cross-user comment modification

Summary

e107 is a content management system (CMS). Prior to 2.3.4, a Broken Access Control vulnerability exists in the application, allowing an unauthorized authenticated user to edit comments posted by others. This stems from inadequate server-side access control validation, where the application depends only on a predictable identifier in the request to determine which comment to edit, without confirming the requesting user’s ownership of the comment. This vulnerability is fixed in 2.3.4.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-26 17:40 UTC

CWE

CWE-284 - Improper Access Control
CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7712 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/e107inc/e107/security/advisori…	x_refsource_CONFIRM
https://github.com/e107inc/e107/commit/23961a8f	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
e107inc	e107	Affected: < 2.3.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-43934",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-26T17:40:26.682147Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-26T17:40:51.812Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/e107inc/e107/security/advisories/GHSA-5w63-63rh-99q6"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "e107",
          "vendor": "e107inc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.3.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "e107 is a content management system (CMS). Prior to 2.3.4, a Broken Access Control vulnerability exists in the application, allowing an unauthorized authenticated user to edit comments posted by others. This stems from inadequate server-side access control validation, where the application depends only on a predictable identifier in the request to determine which comment to edit, without confirming the requesting user\u2019s ownership of the comment. This vulnerability is fixed in 2.3.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-26T14:54:21.210Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/e107inc/e107/security/advisories/GHSA-5w63-63rh-99q6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/e107inc/e107/security/advisories/GHSA-5w63-63rh-99q6"
        },
        {
          "name": "https://github.com/e107inc/e107/commit/23961a8f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/e107inc/e107/commit/23961a8f"
        }
      ],
      "source": {
        "advisory": "GHSA-5w63-63rh-99q6",
        "discovery": "UNKNOWN"
      },
      "title": "e107: Broken Access Control in e107 comment edit allows cross-user comment modification"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-43934",
    "datePublished": "2026-05-26T14:54:21.210Z",
    "dateReserved": "2026-05-04T16:59:09.089Z",
    "dateUpdated": "2026-05-26T17:40:51.812Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55573 (GCVE-0-2026-55573)

Vulnerability from cvelistv5 – Published: 2026-10-14 18:12 – Updated: 2026-10-15 15:01

Title

e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain

Summary

e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting allowed classes. The installer remains accessible after a normal installation, and a crafted object graph using the bundled GuzzleHttp\Psr7\PumpStream class can flow through paths.hash into site_path, where string coercion invokes an attacker-controlled callable. An unauthenticated attacker who can reach install.php can therefore execute arbitrary PHP functions with the web server process's privileges, leading to full server compromise. This issue is fixed in version 2.3.7.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 15:00 UTC

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7712 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/e107inc/e107/security/advisori…	x_refsource_CONFIRM
https://github.com/e107inc/e107/commit/5d6d649e8c…	x_refsource_MISC
https://github.com/e107inc/e107/commit/6c40429521…	x_refsource_MISC
https://github.com/e107inc/e107/releases/tag/v2.3.7	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
e107inc	e107	Affected: < 2.3.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-55573",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T15:00:08.038362Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T15:01:54.402Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/e107inc/e107/security/advisories/GHSA-c8h6-wpj3-4cr8"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "e107",
          "vendor": "e107inc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.3.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting allowed classes. The installer remains accessible after a normal installation, and a crafted object graph using the bundled GuzzleHttp\\Psr7\\PumpStream class can flow through paths.hash into site_path, where string coercion invokes an attacker-controlled callable. An unauthenticated attacker who can reach install.php can therefore execute arbitrary PHP functions with the web server process\u0027s privileges, leading to full server compromise. This issue is fixed in version 2.3.7."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502: Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T18:12:58.640Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/e107inc/e107/security/advisories/GHSA-c8h6-wpj3-4cr8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/e107inc/e107/security/advisories/GHSA-c8h6-wpj3-4cr8"
        },
        {
          "name": "https://github.com/e107inc/e107/commit/5d6d649e8cf01854d6024d07997c2449fdd75f24",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/e107inc/e107/commit/5d6d649e8cf01854d6024d07997c2449fdd75f24"
        },
        {
          "name": "https://github.com/e107inc/e107/commit/6c404295213952aedb9b3689be19dd4c7ba550b0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/e107inc/e107/commit/6c404295213952aedb9b3689be19dd4c7ba550b0"
        },
        {
          "name": "https://github.com/e107inc/e107/releases/tag/v2.3.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/e107inc/e107/releases/tag/v2.3.7"
        }
      ],
      "source": {
        "advisory": "GHSA-c8h6-wpj3-4cr8",
        "discovery": "UNKNOWN"
      },
      "title": "e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55573",
    "datePublished": "2026-10-14T18:12:58.640Z",
    "dateReserved": "2026-06-16T23:11:20.214Z",
    "dateUpdated": "2026-10-15T15:01:54.402Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-55572 (GCVE-0-2026-55572)

Vulnerability from cvelistv5 – Published: 2026-10-14 18:12 – Updated: 2026-10-14 18:12

Title

e107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login username

Summary

e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php. The login() methods execute those strings with PDO::query() before effective sanitization, so an unauthenticated user can inject SQL when alt_auth is installed and either backend is configured with a live external database connection. The injection can expose or modify data available to the configured database account, and query failures can additionally disclose the generated query through the debug-message path. This issue is fixed in version 2.3.7.

Severity

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7712 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/e107inc/e107/security/advisori…	x_refsource_CONFIRM
https://github.com/e107inc/e107/commit/120bd4bdbe…	x_refsource_MISC
https://github.com/e107inc/e107/releases/tag/v2.3.7	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
e107inc	e107	Affected: < 2.3.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "e107",
          "vendor": "e107inc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.3.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin\u0027s otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php. The login() methods execute those strings with PDO::query() before effective sanitization, so an unauthenticated user can inject SQL when alt_auth is installed and either backend is configured with a live external database connection. The injection can expose or modify data available to the configured database account, and query failures can additionally disclose the generated query through the debug-message path. This issue is fixed in version 2.3.7."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T18:12:10.984Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/e107inc/e107/security/advisories/GHSA-5f75-c25x-59wx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/e107inc/e107/security/advisories/GHSA-5f75-c25x-59wx"
        },
        {
          "name": "https://github.com/e107inc/e107/commit/120bd4bdbe18c8690c60a007ad6716e52e6ee965",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/e107inc/e107/commit/120bd4bdbe18c8690c60a007ad6716e52e6ee965"
        },
        {
          "name": "https://github.com/e107inc/e107/releases/tag/v2.3.7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/e107inc/e107/releases/tag/v2.3.7"
        }
      ],
      "source": {
        "advisory": "GHSA-5f75-c25x-59wx",
        "discovery": "UNKNOWN"
      },
      "title": "e107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login username"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-55572",
    "datePublished": "2026-10-14T18:12:10.984Z",
    "dateReserved": "2026-06-16T23:11:20.214Z",
    "dateUpdated": "2026-10-14T18:12:10.984Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-57859 (GCVE-0-2026-57859)

Vulnerability from cvelistv5 – Published: 2026-07-30 13:41 – Updated: 2026-08-14 16:50

Title

e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize()

Summary

e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the user_prefs column. The e_array::unserialize() function in e107_handlers/core_functions.php performs only a prefix check for the string 'array' before passing the stored value to eval(), causing automatic PHP execution whenever the affected user's preferences are materialized through e_user_pref::load().

Severity

7.7 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-30 14:25 UTC

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

VulnCheck CNA under the mitre root

CNA scorecard B 84/100 over 6248 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/e107inc/e107/security/advisori…	vendor-advisory
https://github.com/e107inc/e107/commit/40e73cefde…	patch
https://github.com/e107inc/e107	technical-description
https://www.vulncheck.com/advisories/e107-second-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
e107inc	e107	Affected: 0 , ≤ 2.3.7 (semver) Unaffected: 2.3.8 (semver) cpe:2.3:a:e107:e107::::::::

Date Public

2026-07-30 00:00

Credits

Usmon Khudoyorov

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-57859",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-30T14:25:32.307197Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-30T14:25:51.954Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/e107inc/e107/security/advisories/GHSA-568x-w5qj-vr7c"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "e107",
          "vendor": "e107inc",
          "versions": [
            {
              "lessThanOrEqual": "2.3.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.3.8",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:e107:e107:*:*:*:*:*:*:*:*",
                  "versionEndIncluding": "2.3.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Usmon Khudoyorov"
        }
      ],
      "datePublic": "2026-07-30T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the user_prefs column. The e_array::unserialize() function in e107_handlers/core_functions.php performs only a prefix check for the string \u0027array\u0027 before passing the stored value to eval(), causing automatic PHP execution whenever the affected user\u0027s preferences are materialized through e_user_pref::load()."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-14T16:50:24.335Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-568x-w5qj-vr7c)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/e107inc/e107/security/advisories/GHSA-568x-w5qj-vr7c"
        },
        {
          "name": "Patch Commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/e107inc/e107/commit/40e73cefde85b32e1227dfac9956a5cb87046277"
        },
        {
          "name": "Product Repository",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/e107inc/e107"
        },
        {
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/e107-second-order-code-execution-via-eval-based-deserialization-in-e-array-unserialize"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize()",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-57859",
    "datePublished": "2026-07-30T13:41:34.196Z",
    "dateReserved": "2026-06-25T18:48:00.283Z",
    "dateUpdated": "2026-08-14T16:50:24.335Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-48997 (GCVE-0-2026-48997)

Vulnerability from cvelistv5 – Published: 2026-06-17 21:42 – Updated: 2026-06-18 13:06

Title

e107: Command Injection via shell expansion in ImageMagick resize destination path

Summary

e107 is a content management system (CMS). Versions 2.3.5 and earlier contain a command injection vulnerability in the ImageMagick resize destination path. In resize_image(), the source path is escaped with escapeshellarg(), but the destination path is inserted inside raw double quotes in the convert command; in the submit-news upload flow, that destination filename includes the first six characters of user-controlled news title input. Because the title filter removes literal spaces but not tab characters, and shell expansions such as $(...) and backticks can survive into the quoted destination argument, /bin/sh -c may evaluate attacker-controlled input. Exploitation is possible only when all of the following non-default settings are enabled: resize_method=ImageMagick, subnews_attach=1, upload_enabled=1, subnews_resize is numeric between 30 and 5000, and the attacker is a non-admin in classes permitted by both subnews_class and upload_class. This issue has been fixed in version 2.3.6.

Severity

7.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-18 13:05 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7712 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/e107inc/e107/security/advisori…	x_refsource_CONFIRM
https://github.com/e107inc/e107/releases/tag/v2.3.6	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
e107inc	e107	Affected: < 2.3.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-48997",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-18T13:05:40.518821Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-18T13:06:02.489Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/e107inc/e107/security/advisories/GHSA-3j33-c9v4-4p42"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "e107",
          "vendor": "e107inc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.3.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "e107 is a content management system (CMS). Versions  2.3.5 and earlier contain a command injection vulnerability in the ImageMagick resize destination path. In resize_image(), the source path is escaped with escapeshellarg(), but the destination path is inserted inside raw double quotes in the convert command; in the submit-news upload flow, that destination filename includes the first six characters of user-controlled news title input. Because the title filter removes literal spaces but not tab characters, and shell expansions such as $(...) and backticks can survive into the quoted destination argument, /bin/sh -c may evaluate attacker-controlled input. Exploitation is possible only when all of the following non-default settings are enabled: resize_method=ImageMagick, subnews_attach=1, upload_enabled=1, subnews_resize is numeric between 30 and 5000, and the attacker is a non-admin in classes permitted by both subnews_class and upload_class. This issue has been fixed in version 2.3.6."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-17T21:42:59.679Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/e107inc/e107/security/advisories/GHSA-3j33-c9v4-4p42",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/e107inc/e107/security/advisories/GHSA-3j33-c9v4-4p42"
        },
        {
          "name": "https://github.com/e107inc/e107/releases/tag/v2.3.6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/e107inc/e107/releases/tag/v2.3.6"
        }
      ],
      "source": {
        "advisory": "GHSA-3j33-c9v4-4p42",
        "discovery": "UNKNOWN"
      },
      "title": "e107: Command Injection via shell expansion in ImageMagick resize destination path"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-48997",
    "datePublished": "2026-06-17T21:42:59.679Z",
    "dateReserved": "2026-05-26T23:26:07.976Z",
    "dateUpdated": "2026-06-18T13:06:02.489Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46620 (GCVE-0-2026-46620)

Vulnerability from cvelistv5 – Published: 2026-05-26 15:04 – Updated: 2026-05-27 16:04

Title

e107: CSRF in comment.php moderation endpoints via token-optional validation in session_handler::check()

Summary

e107 is a content management system (CMS). Prior to 2.3.5, e107 CMS does not properly enforce CSRF token validation on comment moderation actions. The problem comes down to how session_handler::check() handles CSRF tokens. Instead of requiring a token on every state-changing request, it only validates the token if one happens to be present. If there is no token at all, the check is skipped entirely. This vulnerability is fixed in 2.3.5.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-27 16:04 UTC

CWE

CWE-285 - Improper Authorization
CWE-352 - Cross-Site Request Forgery (CSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7712 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/e107inc/e107/security/advisori…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
e107inc	e107	Affected: < 2.3.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-46620",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-27T16:04:28.086263Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-27T16:04:41.864Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/e107inc/e107/security/advisories/GHSA-m4hh-m278-jwg5"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "e107",
          "vendor": "e107inc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.3.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "e107 is a content management system (CMS). Prior to 2.3.5, e107 CMS does not properly enforce CSRF token validation on comment moderation actions. The problem comes down to how session_handler::check() handles CSRF tokens. Instead of requiring a token on every state-changing request, it only validates the token if one happens to be present. If there is no token at all, the check is skipped entirely. This vulnerability is fixed in 2.3.5."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285: Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-26T15:04:32.092Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/e107inc/e107/security/advisories/GHSA-m4hh-m278-jwg5",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/e107inc/e107/security/advisories/GHSA-m4hh-m278-jwg5"
        }
      ],
      "source": {
        "advisory": "GHSA-m4hh-m278-jwg5",
        "discovery": "UNKNOWN"
      },
      "title": "e107: CSRF in comment.php moderation endpoints via token-optional validation in session_handler::check()"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-46620",
    "datePublished": "2026-05-26T15:04:32.092Z",
    "dateReserved": "2026-05-15T19:34:14.012Z",
    "dateUpdated": "2026-05-27T16:04:41.864Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43935 (GCVE-0-2026-43935)

Vulnerability from cvelistv5 – Published: 2026-05-26 15:01 – Updated: 2026-05-26 15:49

Title

e107: Host Header Injection in e107 password reset enables phishing

Summary

e107 is a content management system (CMS). Prior to 2.3.4, a Host Header Injection vulnerability in the password reset page allows attackers to manipulate the Host header to generate password reset links pointing to attacker-controlled domains. This can lead to phishing attacks, account takeover, or other security risks. The severity is high, as the vulnerability affects a critical function related to user authentication. This vulnerability is fixed in 2.3.4.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-26 15:49 UTC

CWE

CWE-20 - Improper Input Validation
CWE-807 - Reliance on Untrusted Inputs in a Security Decision

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7712 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/e107inc/e107/security/advisori…	x_refsource_CONFIRM
https://github.com/e107inc/e107/commit/04511f9f1d…	x_refsource_MISC
https://github.com/e107inc/e107/commit/b0dee8234e…	x_refsource_MISC
https://github.com/e107inc/e107/commit/c4f9f71b0f…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
e107inc	e107	Affected: < 2.3.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-43935",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-26T15:49:32.402267Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-26T15:49:36.185Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/e107inc/e107/security/advisories/GHSA-7pmw-jwvr-cq2x"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "e107",
          "vendor": "e107inc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.3.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "e107 is a content management system (CMS). Prior to 2.3.4, a Host Header Injection vulnerability in the password reset page allows attackers to manipulate the Host header to generate password reset links pointing to attacker-controlled domains. This can lead to phishing attacks, account takeover, or other security risks. The severity is high, as the vulnerability affects a critical function related to user authentication. This vulnerability is fixed in 2.3.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-807",
              "description": "CWE-807: Reliance on Untrusted Inputs in a Security Decision",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-26T15:01:36.720Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/e107inc/e107/security/advisories/GHSA-7pmw-jwvr-cq2x",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/e107inc/e107/security/advisories/GHSA-7pmw-jwvr-cq2x"
        },
        {
          "name": "https://github.com/e107inc/e107/commit/04511f9f1d6e97c31ba7cc5bf7f1f9a19d221db6",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/e107inc/e107/commit/04511f9f1d6e97c31ba7cc5bf7f1f9a19d221db6"
        },
        {
          "name": "https://github.com/e107inc/e107/commit/b0dee8234e273debbf7a8ae054de464f1008f357",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/e107inc/e107/commit/b0dee8234e273debbf7a8ae054de464f1008f357"
        },
        {
          "name": "https://github.com/e107inc/e107/commit/c4f9f71b0fd695545d0f09e2277b6f70ff4660fc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/e107inc/e107/commit/c4f9f71b0fd695545d0f09e2277b6f70ff4660fc"
        }
      ],
      "source": {
        "advisory": "GHSA-7pmw-jwvr-cq2x",
        "discovery": "UNKNOWN"
      },
      "title": "e107: Host Header Injection in e107 password reset enables phishing"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-43935",
    "datePublished": "2026-05-26T15:01:36.720Z",
    "dateReserved": "2026-05-04T16:59:09.089Z",
    "dateUpdated": "2026-05-26T15:49:36.185Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43934 (GCVE-0-2026-43934)

Vulnerability from cvelistv5 – Published: 2026-05-26 14:54 – Updated: 2026-05-26 17:40

Title

e107: Broken Access Control in e107 comment edit allows cross-user comment modification

Summary

e107 is a content management system (CMS). Prior to 2.3.4, a Broken Access Control vulnerability exists in the application, allowing an unauthorized authenticated user to edit comments posted by others. This stems from inadequate server-side access control validation, where the application depends only on a predictable identifier in the request to determine which comment to edit, without confirming the requesting user’s ownership of the comment. This vulnerability is fixed in 2.3.4.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-26 17:40 UTC

CWE

CWE-284 - Improper Access Control
CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7712 records in the last 180 days details

References

2 references

URL	Tags
https://github.com/e107inc/e107/security/advisori…	x_refsource_CONFIRM
https://github.com/e107inc/e107/commit/23961a8f	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
e107inc	e107	Affected: < 2.3.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-43934",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-26T17:40:26.682147Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-26T17:40:51.812Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/e107inc/e107/security/advisories/GHSA-5w63-63rh-99q6"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "e107",
          "vendor": "e107inc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.3.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "e107 is a content management system (CMS). Prior to 2.3.4, a Broken Access Control vulnerability exists in the application, allowing an unauthorized authenticated user to edit comments posted by others. This stems from inadequate server-side access control validation, where the application depends only on a predictable identifier in the request to determine which comment to edit, without confirming the requesting user\u2019s ownership of the comment. This vulnerability is fixed in 2.3.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284: Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-26T14:54:21.210Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/e107inc/e107/security/advisories/GHSA-5w63-63rh-99q6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/e107inc/e107/security/advisories/GHSA-5w63-63rh-99q6"
        },
        {
          "name": "https://github.com/e107inc/e107/commit/23961a8f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/e107inc/e107/commit/23961a8f"
        }
      ],
      "source": {
        "advisory": "GHSA-5w63-63rh-99q6",
        "discovery": "UNKNOWN"
      },
      "title": "e107: Broken Access Control in e107 comment edit allows cross-user comment modification"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-43934",
    "datePublished": "2026-05-26T14:54:21.210Z",
    "dateReserved": "2026-05-04T16:59:09.089Z",
    "dateUpdated": "2026-05-26T17:40:51.812Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-43936 (GCVE-0-2026-43936)

Vulnerability from cvelistv5 – Published: 2026-05-26 14:51 – Updated: 2026-05-26 16:21

Title

e107: Server-Side Request Forgery (SSRF) in the remote file fetcher

Summary

e107 is a content management system (CMS). Prior to 2.3.4, you can access the local environment by specifying the URL of the local environment from "Image/File URL:" of "From a remote location" in "Media Manager" on the administrator screen. This vulnerability is fixed in 2.3.4.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-26 16:20 UTC

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7712 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/e107inc/e107/security/advisori…	x_refsource_CONFIRM
https://github.com/e107inc/e107/commit/40b2d111	x_refsource_MISC
https://github.com/e107inc/e107/commit/5f98cc9f	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
e107inc	e107	Affected: < 2.3.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-43936",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-26T16:20:54.858253Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-26T16:21:18.449Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/e107inc/e107/security/advisories/GHSA-92fr-7h4f-22pp"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "e107",
          "vendor": "e107inc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.3.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "e107 is a content management system (CMS). Prior to 2.3.4, you can access the local environment by specifying the URL of the local environment from \"Image/File URL:\" of \"From a remote location\" in \"Media Manager\" on the administrator screen. This vulnerability is fixed in 2.3.4."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-26T14:51:49.317Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/e107inc/e107/security/advisories/GHSA-92fr-7h4f-22pp",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/e107inc/e107/security/advisories/GHSA-92fr-7h4f-22pp"
        },
        {
          "name": "https://github.com/e107inc/e107/commit/40b2d111",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/e107inc/e107/commit/40b2d111"
        },
        {
          "name": "https://github.com/e107inc/e107/commit/5f98cc9f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/e107inc/e107/commit/5f98cc9f"
        }
      ],
      "source": {
        "advisory": "GHSA-92fr-7h4f-22pp",
        "discovery": "UNKNOWN"
      },
      "title": "e107: Server-Side Request Forgery (SSRF) in the remote file fetcher"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-43936",
    "datePublished": "2026-05-26T14:51:49.317Z",
    "dateReserved": "2026-05-04T16:59:09.089Z",
    "dateUpdated": "2026-05-26T16:21:18.449Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria

16 vulnerabilities found for e107 by e107inc

CVE-2026-55573 (GCVE-0-2026-55573)

CVE-2026-55572 (GCVE-0-2026-55572)

CVE-2026-57859 (GCVE-0-2026-57859)

CVE-2026-48997 (GCVE-0-2026-48997)

CVE-2026-46620 (GCVE-0-2026-46620)

CVE-2026-43936 (GCVE-0-2026-43936)

CVE-2026-43935 (GCVE-0-2026-43935)

CVE-2026-43934 (GCVE-0-2026-43934)

CVE-2026-55573 (GCVE-0-2026-55573)

CVE-2026-55572 (GCVE-0-2026-55572)

CVE-2026-57859 (GCVE-0-2026-57859)

CVE-2026-48997 (GCVE-0-2026-48997)

CVE-2026-46620 (GCVE-0-2026-46620)

CVE-2026-43935 (GCVE-0-2026-43935)

CVE-2026-43934 (GCVE-0-2026-43934)

CVE-2026-43936 (GCVE-0-2026-43936)