CVE-2026-55572

CRITICAL 10.0CVE-2026-55572 · Published 14/10/2026 · updated 29/10/2026

In short

CVE-2026-55572 is a CRITICAL (CVSS 10.0) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 0.52%, higher than 43.9% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php. The login() methods execute those strings with PDO::query() before effective sanitization, so an unauthenticated user can inject SQL when alt_auth is installed and either backend is configured with a live external database connection. The injection can expose or modify data available to the configured database account, and query failures can additionally disclose the generated query through the debug-message path. This issue is fixed in version 2.3.7.

References

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free