PT-2026-43267 · E107 · E107

Piyushthepal · CVE-2026-43935 · Published 2026-05-26 · Updated 2026-05-26

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions e107 versions prior to 2.3.4

Description e107 is a content management system (CMS). A Host Header Injection in the password reset page allows attackers to manipulate the Host header to generate password reset links that point to domains controlled by the attacker. This can lead to account takeover or phishing attacks.

Recommendations Update to version 2.3.4.

Exploit

Fix

RCE

Weakness Enumeration

CWE-807

CWE-20

Related Identifiers

CVE-2026-43935

GHSA-7PMW-JWVR-CQ2X

Affected Products

E107

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43935.json · Exploit
• 🔥 https://github.com/e107inc/e107/security/advisories/GHSA-7pmw-jwvr-cq2x · Exploit
• https://osv.dev/vulnerability/CVE-2026-43935 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43935 · Security Note
• https://github.com/e107inc/e107/commit/b0dee8234e273debbf7a8ae054de464f1008f357 · Note
• https://github.com/e107inc/e107/commit/c4f9f71b0fd695545d0f09e2277b6f70ff4660fc · Note
• https://github.com/e107inc/e107/commit/04511f9f1d6e97c31ba7cc5bf7f1f9a19d221db6 · Note
• https://t.me/CVEtracker/54982 · Telegram Post