Reflected Cross-Site Scripting Vulnerability in e107 CMS
CVE-2026-114407

5.1MEDIUM

Key Information:

Vendor

E107inc

Status
E107
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114407?

The e107 CMS prior to version 2.3.13 is susceptible to a reflected cross-site scripting vulnerability. This flaw enables unauthenticated attackers to exploit the author GET parameter in search.php to inject malicious HTML. By manipulating this parameter, attackers can bypass the HTML input restrictions and embed an img element equipped with an onerror handler, resulting in the execution of arbitrary JavaScript within a victim's browser. This vulnerability can facilitate various forms of attacks, compromising user sessions and data integrity.

Affected Version(s)

e107 2.2.0 < 2.3.13

References

https://github.com/e107inc/e107/security/advisories/GHSA-...
vendor-advisorytechnical-description
https://github.com/e107inc/e107/releases/tag/v2.3.13
patchissue-tracking
https://www.vulncheck.com/advisories/e107-cms-before-refl...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lazizbek Djurayev (Haad TC)
.