CVE-2026-72599: e107 e107 - SQL Injection
Published Aug 11, 2026
·Updated
An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter is concatenated without escaping into a SQL WHERE clause. An unauthenticated attacker can read, modify, or delete all database contents including administrator credentials.
Affected Software
1 affected component
e107 e107=2.4.0
Event History
Aug 11, 2026
CVE Published
via MITRE·11:14 AM
Data Sourced
via MITRE·11:14 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·12:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-72599?
CVE-2026-72599 has a severity rating of critical with a score of 9.8.
2
How do I fix CVE-2026-72599?
To fix CVE-2026-72599, update e107 to the latest version that addresses this SQL injection vulnerability.
3
What can attackers do with CVE-2026-72599?
Attackers exploiting CVE-2026-72599 can execute arbitrary SQL commands, allowing them to read, modify, or delete database contents.
4
Who is affected by CVE-2026-72599?
CVE-2026-72599 affects all installations of e107 version 2.4.0.
5
When was CVE-2026-72599 published?
CVE-2026-72599 was published on August 11, 2026.