What is the CVSS score of EUVD-2026-56038?

EUVD-2026-56038 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of e107 are affected by EUVD-2026-56038?

e107 CMS versions 2.4.0 and earlier contain a critical SQL injection vulnerability allowing unauthenticated remote attackers to execute arbitrary SQL commands against the backend database.

How to fix or mitigate EUVD-2026-56038?

Within 24 hours, identify all e107 CMS installations running version 2.4.0 or earlier and assess internet accessibility; implement temporary network controls to restrict CMS access where feasible and deploy Web Application Firewall rules to block SQL injection patterns in the page ID parameter. Within 7 days, establish detailed monitoring for exploitation attempts in web application and database audit logs with real-time alerting. Within 30 days, execute an upgrade plan to migrate away from affected versions, as no vendor patch is currently available; until complete, maintain strict network access controls and implement database permission restrictions limiting the CMS application account to minimum required privileges.

e107 EUVD-2026-56038

| CVE-2026-72599 CRITICAL

SQL Injection (CWE-89)

2026-08-11 TuranSec

GHSA-85cw-qx9x-rj5j

SQLi E107

9.8

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable SQLi (AV:N/AC:L/PR:N/UI:N) giving full database read/modify/delete, so C:H/I:H/A:H; scope unchanged as impact stays within the DB.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 12:15 vuln.today

CVE Published

Aug 11, 2026 - 11:14 cve.org

CRITICAL 9.8

DescriptionCVE.org

An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter is concatenated without escaping into a SQL WHERE clause. An unauthenticated attacker can read, modify, or delete all database contents including administrator credentials.

AnalysisAI

SQL injection in e107 CMS version 2.4.0 (and earlier) lets unauthenticated remote attackers inject arbitrary SQL through the news item page ID parameter, which is concatenated unescaped into a WHERE clause. Because no authentication is required and the flaw yields full read/write/delete access to the backend database - including administrator credential hashes - it enables complete site compromise. No public exploit has been identified at time of analysis, though the trivial injection point makes exploitation straightforward.

Technical ContextAI

e107 is an open-source PHP-based content management system that uses a MySQL/MariaDB backend for storing content, users, and configuration. The vulnerability is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) defect: the news module builds a SQL WHERE clause by directly concatenating the attacker-controllable page/item ID rather than using parameterized queries or the framework's input-sanitization helpers. The single affected CPE, cpe:2.3:a:e107:e107, confirms the core application itself is impacted rather than a third-party plugin, meaning default installations that expose the news feature are affected.

RemediationAI

No vendor-released patch version is identified at time of analysis - the only reference is the upstream repository (https://github.com/e107inc/e107), not a tagged fixed release, so administrators should monitor that repository and e107 release announcements for a patched version above 2.4.0 and upgrade as soon as one is published. Because the flaw is in the core news module's handling of the item/page ID, effective interim compensating controls include placing a web application firewall (WAF) rule in front of the site to block SQL metacharacters and typical injection patterns on the news page ID parameter (trade-off: may cause false positives on legitimate content and requires tuning), restricting or disabling public access to the news module/page if it is not business-critical (trade-off: removes news functionality for visitors), and enforcing least-privilege on the database account used by e107 so it cannot drop tables or reach other schemas (trade-off: limits blast radius but does not stop credential/content theft). Verify any downloaded fix against the official e107 GitHub repository before deploying.