Login Request a demo
E1
Product
e107
by e107inc · last CVE Oct 21, 2026
9
CVEs
0
On KEV
10.0
Max CVSS
3
New 30D
Vulnerabilities9In the news0Timeline
Severity mix
Critical 2High 3Medium 4Low 0
Severity
All severities9Critical2High3Medium4Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add e107 to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-55572
10.0
1%
Oct 14
e107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login username
Affected: < 2.3.7
CVE-2026-55573
9.8
1%
Oct 14
e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain
Affected: < 2.3.7
CVE-2026-43935
8.1
0%
May 26
e107: Host Header Injection in e107 password reset enables phishing
Affected: < 2.3.4
CVE-2026-57859
7.5
1%
Jul 30
e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize()
Affected: through 2.3.7
CVE-2026-48997
7.1
1%
Jun 17
e107: Command Injection via shell expansion in ImageMagick resize destination path
Affected: < 2.3.6
CVE-2026-46620
6.5
0%
May 26
e107: CSRF in comment.php moderation endpoints via token-optional validation in session_handler::check()
Affected: < 2.3.5
CVE-2026-43934
6.5
0%
May 26
e107: Broken Access Control in e107 comment edit allows cross-user comment modification
Affected: < 2.3.4
CVE-2026-114407
6.1
0%
Oct 21
e107 CMS before 2.3.13 Reflected XSS via search.php author Parameter
Affected: 2.2.0 before 2.3.13
CVE-2026-43936
4.3
0%
May 26
e107: Server-Side Request Forgery (SSRF) in the remote file fetcher
Affected: < 2.3.4
Showing 9