Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpolate the submitted login username directly into SQL in e107_plugins/alt_auth/otherdb_auth.php and e107_plugins/alt_auth/e107db_auth.php. The login() methods execute those strings with PDO::query() before effective sanitization, so an unauthenticated user can inject SQL when alt_auth is installed and either backend is configured with a live external database connection. The injection can expose or modify data available to the configured database account, and query failures can additionally disclose the generated query through the debug-message path. This issue is fixed in version 2.3.7.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
ExploitGrid Daily Digest 🚨 Top CVEs: CVE-2026-107594 (CVSS: 10) Unknown CVE-2026-110536 (CVSS: 10) dlink CVE-2026-55572 (CVSS: 10) e107inc CVE-2026-108390 (CVSS: 9.9) hestiacp CVE-2026-77524 (CVSS: 9.9) kedacore ..🧵👇
🟠 HIGH PRIORITY (CVSS 9.9-10) ├ CVE-2026-107594 · File Upload to Order < 1.1.4 · Unauth arbitrary file deletion (10) ├ CVE-2026-110536 · D-Link DIR-868L · OS command injection via HNAP CGI (10) ├ CVE-2026-55572 · e107 · SQL injection in alt_auth plugin (10)
[CVE] CVE-2026-55572 [HIGH PRIORITY] CVSS: 10 | Vendor: #e107inc #e107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login ... 🔗 https://exploitgrid.net/cve/CVE-2026-55572