CVE-2026-55572

The record

e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php. The login() methods execute those strings with PDO::query() before effective sanitization, so an unauthenticated user can inject SQL when alt_auth is installed and either backend is configured with a live external database connection. The injection can expose or modify data available to the configured database account, and query failures can additionally disclose the generated query through the debug-message path. This issue is fixed in version 2.3.7.

Affected packages

Related vulnerabilities

• CVE-2026-63224 OpenRemote is an open-source internet-of-things platform. CWE-89
• CVE-2026-62849 ThingLinks is an enterprise IoT platform. CWE-89
• CVE-2026-61620 HoneySQL turns Clojure data structures into SQL. CWE-89
• CVE-2026-39732 Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions. CWE-89
• CVE-2026-119619 A vulnerability was found in 37954679 cak-filemanagement-system up to… CWE-89
• CVE-2026-115820 The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for… CWE-89
• CVE-2026-119656 CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection… CWE-89
• CVE-2026-119655 CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the… CWE-89