CVE-2026-72599 in e107información

Resumen

por MITRE • 2026-08-11

An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter is concatenated without escaping into a SQL WHERE clause. An unauthenticated attacker can read, modify, or delete all database contents including administrator credentials.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

🔬 Show More Details

An in-depth analysis is available in our curated vulnerability entry.

Responsable

TuranSec

Reservar

2026-08-10

Divulgación

2026-08-11

Moderación

aceptado

Artículo

VDB-388067

CPE

listo

EPSS

0.00000

KEV

no

Actividades

bajo

Sector

Hostingprovider, Lawfirm, ...

Fuentes

MITREhttps://www.cve.org/CVERecord?id=CVE-2026-72599
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-72599
CVE Detailshttps://www.cvedetails.com/cve/CVE-2026-72599/

◂ AnteriorVisión De ConjuntoPróximo ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!