CVE-2026-114407: e107 CMS before 2.3.13 Reflected XSS via search.php author Parameter
e107 CMS before 2.3.13 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML by manipulating the author GET parameter in search.php, which is parsed with parsestr() and concatenated unescaped into a rendered input tag via the form handler's 'other' option key. Attackers can craft a single GET request containing a crafted author parameter to break out of the HTML input tag and inject an img element with an onerror handler, executing arbitrary JavaScript in the victim's browser session.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
e107 CMS versions before 2.3.13 are affected. The issue is reachable through search.php when processing the author GET parameter.
What does an attacker need to exploit this issue?
An attacker does not need authentication and can use a single crafted GET request. Exploitation requires a victim to interact with the crafted request so the injected JavaScript executes in that victim's browser session.
What is the immediate remediation?
Upgrade e107 CMS to version 2.3.13 or later. The affected behavior is the unescaped handling of the author parameter in search.php.