CVE-2026-72599
e107 e107 - SQL Injection
- State
- Published
- Severity
- 9.8 Critical
- Published
- Aug 11, 2026
- Updated
- Aug 11, 2026
- Reserved
- Aug 10, 2026
Description
An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter is concatenated without escaping into a SQL WHERE clause. An unauthenticated attacker can read, modify, or delete all database contents including administrator credentials.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | TuranSec |
Weaknesses
- CWE-89 SQL Injection
Affected Products
| Product | Versions |
|---|---|
e107e107 |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.