Live › vulnerability › CVE-2026-114407
Go to dashboarde107 CMS before 2.3.13 reflects the author GET parameter in search.php into an HTML input tag without escaping. An attacker who gets a victim to open a crafted link can run JavaScript in the victim's browser session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running e107 CMS before 2.3.13 that expose the search.php page to visitors. Sites on a patched version, or that do not run e107, can skip it.
No product ranges from the sources yet.
2.3.13 are affected.search.php with an author parameter containing HTML-breaking characters and see whether it is echoed unescaped (unknown whether sources give an exact test).2.3.13 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML by manipulating the author GET parameter in search.php, which is parsed with parse_str() and concatenated unescaped into a rendered input tag via the form handler's 'other' option key. Attackers can craft a single GET request containing a crafted author parameter to break out of the HTML input tag and inject an img element with an onerror handler, executing arbitrary JavaScript in the victim's browser session.
This page as .md · .json · in your agent: get_signal("CVE-2026-114407")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.