Skip to content
OpenAdvisories

Vendor

e107inc

9 known vulnerabilities.

Products

e107 9
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-55573

    e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain

    e107 is a content management system (CMS). Prior to 2.3.7, install.php decodes the attacker-controlled previous_steps POST parameter and passes it to unserialize() at file scope and again in the e_install constructor without restricting allowed classes. The i…

    e107inc e107
  • Critical 10.0
    CVE-2026-55572

    e107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login username

    e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/…

    e107inc e107