CVE-2026-114407 e107 CMS before 2.3.13 Reflected XSS via search.php author Parameter
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-114407?
CVE-2026-114407 is a medium-severity vulnerability in e107inc e107, published on 21 Oct 2026.
Official description
e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML by manipulating the author GET parameter in search.php, which is parsed with parse_str() and concatenated unescaped into a rendered input tag via the form handler's 'other' option key. Attackers can craft a single GET request containing a crafted author parameter to break out of the HTML input tag and inject an img element with an onerror handler, executing arbitrary JavaScript in the victim's browser session.
Weakness: CWE-79
Which versions are affected by CVE-2026-114407?
How do I fix CVE-2026-114407?
No fix has been published for CVE-2026-114407 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-114407 being exploited?
There is no known exploitation of CVE-2026-114407 in the wild and no public exploit code.
Sources
Also known as GHSA-26h5-jjjv-6774, GHSA-g7rc-4jvq-27m9.