PT-2026-43267 · E107 · E107

Piyushthepal · Published 2026-05-26 · Updated 2026-05-26 · CVE-2026-43935

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions e107 versions prior to 2.3.4

Description e107 is a content management system (CMS). A Host Header Injection in the password reset page allows attackers to manipulate the Host header to generate password reset links that point to domains controlled by the attacker. This can lead to account takeover or phishing attacks.

Recommendations Update to version 2.3.4.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

CWE-807

Related Identifiers

CVE-2026-43935

Affected Products

E107

References · 6

• 🔥 https://github.com/e107inc/e107/security/advisories/GHSA-7pmw-jwvr-cq2x · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-43935 · Security Note
• https://github.com/e107inc/e107/commit/04511f9f1d6e97c31ba7cc5bf7f1f9a19d221db6 · Note
• https://github.com/e107inc/e107/commit/b0dee8234e273debbf7a8ae054de464f1008f357 · Note
• https://github.com/e107inc/e107/commit/c4f9f71b0fd695545d0f09e2277b6f70ff4660fc · Note
• https://t.me/CVEtracker/54982 · Telegram Post