CVE-2026-114407
Received Received - Intake

Reflected XSS in e107 CMS via search.php author parameter

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: VulnCheck

Description
e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML by manipulating the author GET parameter in search.php, which is parsed with parse_str() and concatenated unescaped into a rendered input tag via the form handler's 'other' option key. Attackers can craft a single GET request containing a crafted author parameter to break out of the HTML input tag and inject an img element with an onerror handler, executing arbitrary JavaScript in the victim's browser session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-21
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-09
NVD
CVE-2026-114407
EUVD
EUVD-2026-107215

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
e107inc e107 2.2.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-114407 is a reflected cross-site scripting (XSS) vulnerability in e107 CMS versions before 2.3.13. It allows unauthenticated attackers to inject malicious scripts by manipulating the 'author' GET parameter in search.php. The input is processed without proper sanitization, enabling attackers to break out of HTML input tags and inject malicious elements like img tags with onerror handlers. This executes arbitrary JavaScript in the victim's browser session.

Detection Guidance

To detect this vulnerability, inspect network traffic for requests to search.php with a crafted author parameter. Check server logs for unusual GET requests containing HTML or JavaScript payloads in the author field. Manually review search.php for improper input handling in the userpicker() function or parse_str() usage without sanitization.

Impact Analysis

For regular users, this vulnerability enables impersonation and content manipulation. For administrators, it can lead to server-side code execution via plugin installation. Attackers can craft a single GET request to exploit this, compromising user sessions and potentially taking over the website.

Compliance Impact

This reflected XSS vulnerability could lead to unauthorized access to sensitive user data, potentially violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Attackers could steal session cookies, impersonate users, or execute actions on their behalf, compromising confidentiality and integrity of data.

Mitigation Strategies

Immediately update e107 to version 2.3.13 or later. If updating is not possible, manually patch search.php to properly escape user input or implement server-side request filtering to block malicious author parameters. Ensure PHP is updated to a patched version to address related vulnerabilities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114407. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...