CVE-2026-114407

Medium

Description

e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML by manipulating the author GET parameter in search.php, which is parsed with parse_str() and concatenated unescaped into a rendered input tag via the form handler's 'other' option key. Attackers can craft a single GET request containing a crafted author parameter to break out of the HTML input tag and inject an img element with an onerror handler, executing arbitrary JavaScript in the victim's browser session.

SeverityMedium

CVSS6.1

Exploit probability—

Product

E107

PublishedOct 21, 2026

First seenOct 21, 2026

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update

e107inc e1072.3.13 or later

Patches

github.com/e107inc/e107/releases/tag/v2.3.13

Vendor advisories

github.com/e107inc/e107/security/advisories/GHSA-g7rc-4jvq-27m9

Affected products

Product	Affected versions	Fixed in
e107inc e107	2.2.0 ≤ v < 2.3.13	2.3.13

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.