The flaw is introduced by the search.php page, which reads the 'author' GET parameter, parses it with parse_str(), and then concatenates the unescaped value into a rendered HTML input element via the form handler's 'other' option key. An attacker can supply a specially crafted author value that terminates the existing input tag and injects an <img> element containing an onerror handler. This injection enables arbitrary JavaScript execution inside the victim's browser session, representing a reflected cross‑site scripting vulnerability (CWE‑79).

The e107 CMS from e107inc is the affected product. Versions prior to 2.3.13 contain the vulnerability. No patch releases other than 2.3.13 are indicated as unaffected, so any installation running a version older than 2.3.13 is at risk.

The CVSS v3.1 score of 5.1 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no current large‑scale exploitation. The attack vector is inferred to be network‑accessible, as the exploit is triggered by a public GET request to search.php. No authentication or privileged access is required, which makes the attack straightforward for a remote adversary. The expected impact is arbitrary JavaScript execution in the victim’s browser, potentially compromising session data or manipulating the page.