CVE-2026-72599CWE-89sql-injection

CVE-2026-72599

Critical · published August 11, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
48.4
In the wild
Unconfirmed
What it is

An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter is concatenated without escaping into a SQL WHERE clause. An unauthenticated attacker can read, modify, or delete all database contents including administrator credentials.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00608 · 48.4th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-08-11T16:17Z
References (1)
https://github.com/e107inc/e107 · 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
EPSS history
Timeline
  • 11 AUG 11:14Z
    e107 e107 - SQL Injection
    cvelistv5