CVE-2026-72599

Name of the Vulnerable Software and Affected Versions e107 version 2.4.0

Description An SQL injection allows unauthenticated remote attackers to execute arbitrary SQL commands. This occurs because the news item page ID parameter is concatenated directly into a SQL WHERE clause without proper escaping. An attacker can leverage this to read, modify, or delete all database contents, including administrator credentials.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.