e107 CMS EUVD-2026-107215

Exploitation requires an unauthenticated attacker to craft a single GET request to e107's search.php with a malicious 'author' parameter that is parsed by parse_str() and concatenated unescaped into a rendered HTML input tag via the form handler's 'other' option key, allowing breakout and injection of an <img onerror=...> payload. The decisive LIMITING factor is required user interaction (UI:A): because this is REFLECTED rather than stored XSS, a victim must be lured into loading the attacker-supplied URL - it does not self-propagate and does not persist on the server. No authentication, no special non-default configuration, and no privileges are needed beyond reaching an e107 instance running a version before 2.3.13 with search.php accessible.

This is a medium-severity reflected XSS (CVSS 4.0 base 5.1, CWE-79) whose real-world priority is moderate-to-low. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) confirms network-reachable, low-complexity, unauthenticated exploitation but REQUIRES active user interaction (UI:A) - the victim must click or load an attacker-crafted search.php URL, which materially limits mass exploitation. Impact metrics reflect the reflected-XSS nature: no direct impact to the vulnerable system (VC:N/VI:N/VA:N) with only low subsequent-system impact (SC:L/SI:L) in the victim's browser session, consistent with session-context script execution rather than server compromise. There is no CISA KEV listing and no public exploit was identified in the provided intelligence, so this is best characterized as a confirmed-but-not-yet-weaponized issue. EPSS was not provided, so exploitation probability cannot be quantified from this data. The absence of KEV/POC combined with a required-user-interaction reflected vector means this is a genuine but not emergency priority: patch in a normal cycle unless the e107 instance is internet-facing and high-value.

An attacker crafts a malicious search.php URL for a target e107 site in which the 'author' GET parameter is manipulated to break out of a rendered HTML input tag and inject an <img> element with an onerror handler. The attacker delivers this link to a victim (e.g., via phishing or a malicious page); when the victim's browser loads it, the injected JavaScript executes in the context of the e107 site, enabling session/cookie theft or actions as the victim. No public exploit code was identified at time of analysis, though the mechanism is clearly described in the vendor advisory.