CVE-2026-72599: e107 e107 - SQL Injection

Published Aug 11, 2026

Updated

An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter is concatenated without escaping into a SQL WHERE clause. An unauthenticated attacker can read, modify, or delete all database contents including administrator credentials.

Event History

Aug 11, 2026

CVE Published

via MITRE·11:14 AM

Data Sourced

via MITRE·11:14 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-72599?

CVE-2026-72599 has a severity rating of critical with a score of 9.8.

How do I fix CVE-2026-72599?

To fix CVE-2026-72599, update e107 to the latest version that addresses this SQL injection vulnerability.

What can attackers do with CVE-2026-72599?

Attackers exploiting CVE-2026-72599 can execute arbitrary SQL commands, allowing them to read, modify, or delete database contents.

Who is affected by CVE-2026-72599?

CVE-2026-72599 affects all installations of e107 version 2.4.0.

When was CVE-2026-72599 published?

CVE-2026-72599 was published on August 11, 2026.

CVE-2026-72599: e107 e107 - SQL Injection

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-72599?

How do I fix CVE-2026-72599?

What can attackers do with CVE-2026-72599?

Who is affected by CVE-2026-72599?

When was CVE-2026-72599 published?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2026-72599?

How do I fix CVE-2026-72599?

What can attackers do with CVE-2026-72599?

Who is affected by CVE-2026-72599?

When was CVE-2026-72599 published?