Common Weakness Enumeration
CWE-601
AllowedURL Redirection to Untrusted Site ('Open Redirect')
Abstraction: Base · Status: Draft
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
2631 vulnerabilities reference this CWE, most recent first.
CVE-2026-112251 (GCVE-0-2026-112251)
Vulnerability from cvelistv5 – Published: 2026-10-19 18:30 – Updated: 2026-10-19 18:49
VLAI
EPSS
VEX
Title
antoinersx clawhost Reverse Proxy reverseProxy.ts handleRequest redirect
Summary
A vulnerability was detected in antoinersx clawhost up to 0.0.45. This affects the function handleRequest of the file apps/clawhostgo/src/main/services/reverseProxy.ts of the component Reverse Proxy. Performing a manipulation of the argument token results in open redirect. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 18:49 UTC
CWE
- CWE-601 - Open Redirect
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422332 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422332/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112251 | third-party-advisory |
| https://vuldb.com/submit/986376 | third-party-advisory |
| https://drive.google.com/drive/folders/1fvX6wjfHd… | exploit |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| antoinersx | clawhost |
Affected:
0.0.1
Affected: 0.0.2 Affected: 0.0.3 Affected: 0.0.4 Affected: 0.0.5 Affected: 0.0.6 Affected: 0.0.7 Affected: 0.0.8 Affected: 0.0.9 Affected: 0.0.10 Affected: 0.0.11 Affected: 0.0.12 Affected: 0.0.13 Affected: 0.0.14 Affected: 0.0.15 Affected: 0.0.16 Affected: 0.0.17 Affected: 0.0.18 Affected: 0.0.19 Affected: 0.0.20 Affected: 0.0.21 Affected: 0.0.22 Affected: 0.0.23 Affected: 0.0.24 Affected: 0.0.25 Affected: 0.0.26 Affected: 0.0.27 Affected: 0.0.28 Affected: 0.0.29 Affected: 0.0.30 Affected: 0.0.31 Affected: 0.0.32 Affected: 0.0.33 Affected: 0.0.34 Affected: 0.0.35 Affected: 0.0.36 Affected: 0.0.37 Affected: 0.0.38 Affected: 0.0.39 Affected: 0.0.40 Affected: 0.0.41 Affected: 0.0.42 Affected: 0.0.43 Affected: 0.0.44 Affected: 0.0.45 cpe:2.3:a:antoinersx:clawhost:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112251",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T18:49:45.731064Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T18:49:54.959Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:antoinersx:clawhost:*:*:*:*:*:*:*:*"
],
"modules": [
"Reverse Proxy"
],
"product": "clawhost",
"vendor": "antoinersx",
"versions": [
{
"status": "affected",
"version": "0.0.1"
},
{
"status": "affected",
"version": "0.0.2"
},
{
"status": "affected",
"version": "0.0.3"
},
{
"status": "affected",
"version": "0.0.4"
},
{
"status": "affected",
"version": "0.0.5"
},
{
"status": "affected",
"version": "0.0.6"
},
{
"status": "affected",
"version": "0.0.7"
},
{
"status": "affected",
"version": "0.0.8"
},
{
"status": "affected",
"version": "0.0.9"
},
{
"status": "affected",
"version": "0.0.10"
},
{
"status": "affected",
"version": "0.0.11"
},
{
"status": "affected",
"version": "0.0.12"
},
{
"status": "affected",
"version": "0.0.13"
},
{
"status": "affected",
"version": "0.0.14"
},
{
"status": "affected",
"version": "0.0.15"
},
{
"status": "affected",
"version": "0.0.16"
},
{
"status": "affected",
"version": "0.0.17"
},
{
"status": "affected",
"version": "0.0.18"
},
{
"status": "affected",
"version": "0.0.19"
},
{
"status": "affected",
"version": "0.0.20"
},
{
"status": "affected",
"version": "0.0.21"
},
{
"status": "affected",
"version": "0.0.22"
},
{
"status": "affected",
"version": "0.0.23"
},
{
"status": "affected",
"version": "0.0.24"
},
{
"status": "affected",
"version": "0.0.25"
},
{
"status": "affected",
"version": "0.0.26"
},
{
"status": "affected",
"version": "0.0.27"
},
{
"status": "affected",
"version": "0.0.28"
},
{
"status": "affected",
"version": "0.0.29"
},
{
"status": "affected",
"version": "0.0.30"
},
{
"status": "affected",
"version": "0.0.31"
},
{
"status": "affected",
"version": "0.0.32"
},
{
"status": "affected",
"version": "0.0.33"
},
{
"status": "affected",
"version": "0.0.34"
},
{
"status": "affected",
"version": "0.0.35"
},
{
"status": "affected",
"version": "0.0.36"
},
{
"status": "affected",
"version": "0.0.37"
},
{
"status": "affected",
"version": "0.0.38"
},
{
"status": "affected",
"version": "0.0.39"
},
{
"status": "affected",
"version": "0.0.40"
},
{
"status": "affected",
"version": "0.0.41"
},
{
"status": "affected",
"version": "0.0.42"
},
{
"status": "affected",
"version": "0.0.43"
},
{
"status": "affected",
"version": "0.0.44"
},
{
"status": "affected",
"version": "0.0.45"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "notwolf (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in antoinersx clawhost up to 0.0.45. This affects the function handleRequest of the file apps/clawhostgo/src/main/services/reverseProxy.ts of the component Reverse Proxy. Performing a manipulation of the argument token results in open redirect. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "Open Redirect",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T18:30:17.553Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422332 | antoinersx clawhost Reverse Proxy reverseProxy.ts handleRequest redirect",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422332"
},
{
"name": "VDB-422332 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422332/cti"
},
{
"name": "CVE-2026-112251 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112251"
},
{
"name": "Submit #986376 | antoinersx clawhost 0.0.45 Local Sensitive Logic Exposure Leading to token leakge",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/986376"
},
{
"tags": [
"exploit"
],
"url": "https://drive.google.com/drive/folders/1fvX6wjfHd58SzCAZd5-4Zn-mh9jqx8mz?usp=drive_link"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-19T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-19T14:57:40.000Z",
"value": "VulDB entry last update"
}
],
"title": "antoinersx clawhost Reverse Proxy reverseProxy.ts handleRequest redirect",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112251",
"datePublished": "2026-10-19T18:30:17.553Z",
"dateReserved": "2026-10-19T12:52:34.042Z",
"dateUpdated": "2026-10-19T18:49:54.959Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112040 (GCVE-0-2026-112040)
Vulnerability from cvelistv5 – Published: 2026-10-19 01:45 – Updated: 2026-10-19 16:36
VLAI
EPSS
VEX
Title
diem-project diem Sign-In BasedmUserActions.class.php redirect
Summary
A vulnerability was determined in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This affects an unknown part of the file dmCorePlugin/plugins/dmUserPlugin/modules/dmUser/lib/BasedmUserActions.class.php of the component Sign-In. This manipulation of the argument Referer causes open redirect. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Severity
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 15:46 UTC
CWE
- CWE-601 - Open Redirect
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/421688 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/421688/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112040 | third-party-advisory |
| https://vuldb.com/submit/1008083 | third-party-advisory |
| https://github.com/diem-project/diem/issues/457 | exploitissue-tracking |
| https://github.com/diem-project/diem/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| diem-project | diem |
Affected:
116974edfb9a5b8bd69cb13586dc62bcdbb485ad
cpe:2.3:a:diem-project:diem:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-112040",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T15:46:34.196976Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T16:36:58.717Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:diem-project:diem:*:*:*:*:*:*:*:*"
],
"modules": [
"Sign-In"
],
"product": "diem",
"vendor": "diem-project",
"versions": [
{
"status": "affected",
"version": "116974edfb9a5b8bd69cb13586dc62bcdbb485ad"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "cnluminous (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in diem-project diem up to 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. This affects an unknown part of the file dmCorePlugin/plugins/dmUserPlugin/modules/dmUser/lib/BasedmUserActions.class.php of the component Sign-In. This manipulation of the argument Referer causes open redirect. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "Open Redirect",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T01:45:16.543Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-421688 | diem-project diem Sign-In BasedmUserActions.class.php redirect",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/421688"
},
{
"name": "VDB-421688 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/421688/cti"
},
{
"name": "CVE-2026-112040 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112040"
},
{
"name": "Submit #1008083 | diem-project diem 116974edfb9a5b8bd69cb13586dc62bcdbb485ad Open Redirect",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1008083"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/diem-project/diem/issues/457"
},
{
"tags": [
"product"
],
"url": "https://github.com/diem-project/diem/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-18T11:57:49.000Z",
"value": "VulDB entry last update"
}
],
"title": "diem-project diem Sign-In BasedmUserActions.class.php redirect",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112040",
"datePublished": "2026-10-19T01:45:16.543Z",
"dateReserved": "2026-10-18T09:52:18.613Z",
"dateUpdated": "2026-10-19T16:36:58.717Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-112034 (GCVE-0-2026-112034)
Vulnerability from cvelistv5 – Published: 2026-10-19 00:15 – Updated: 2026-10-19 00:15
VLAI
EPSS
VEX
Title
aircheng-org iWebShop-5 Login Redirect _userInfo.php redirect
Summary
A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. The impacted element is the function IController::redirect of the file plugins/_userInfo/_userInfo.php of the component Login Redirect. This manipulation of the argument callback causes open redirect. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
Severity
CWE
- CWE-601 - Open Redirect
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/421682 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/421682/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-112034 | third-party-advisory |
| https://vuldb.com/submit/1008389 | third-party-advisory |
| https://github.com/aircheng-org/iWebShop-5/issues/10 | exploitissue-tracking |
| https://github.com/aircheng-org/iWebShop-5/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| aircheng-org | iWebShop-5 |
Affected:
5.0
Affected: 5.1 Affected: 5.2 Affected: 5.3 Affected: 5.4 Affected: 5.5 Affected: 5.6 Affected: 5.7 Affected: 5.8 Affected: 5.9 Affected: 5.10 Affected: 5.11 Affected: 5.12 Affected: 5.13 Affected: 5.14 Affected: 5.15 Affected: 5.16 cpe:2.3:a:aircheng-org:iwebshop-5:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:aircheng-org:iwebshop-5:*:*:*:*:*:*:*:*"
],
"modules": [
"Login Redirect"
],
"product": "iWebShop-5",
"vendor": "aircheng-org",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"status": "affected",
"version": "5.1"
},
{
"status": "affected",
"version": "5.2"
},
{
"status": "affected",
"version": "5.3"
},
{
"status": "affected",
"version": "5.4"
},
{
"status": "affected",
"version": "5.5"
},
{
"status": "affected",
"version": "5.6"
},
{
"status": "affected",
"version": "5.7"
},
{
"status": "affected",
"version": "5.8"
},
{
"status": "affected",
"version": "5.9"
},
{
"status": "affected",
"version": "5.10"
},
{
"status": "affected",
"version": "5.11"
},
{
"status": "affected",
"version": "5.12"
},
{
"status": "affected",
"version": "5.13"
},
{
"status": "affected",
"version": "5.14"
},
{
"status": "affected",
"version": "5.15"
},
{
"status": "affected",
"version": "5.16"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "cnluminous (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. The impacted element is the function IController::redirect of the file plugins/_userInfo/_userInfo.php of the component Login Redirect. This manipulation of the argument callback causes open redirect. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "Open Redirect",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T00:15:19.433Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-421682 | aircheng-org iWebShop-5 Login Redirect _userInfo.php redirect",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/421682"
},
{
"name": "VDB-421682 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/421682/cti"
},
{
"name": "CVE-2026-112034 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-112034"
},
{
"name": "Submit #1008389 | aircheng-org iWebShop-5 eb7f7eb1c6ebf39a54f943d8e0aefe96a3b8ff54 Open Redirect",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1008389"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/aircheng-org/iWebShop-5/issues/10"
},
{
"tags": [
"product"
],
"url": "https://github.com/aircheng-org/iWebShop-5/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-18T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-18T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-18T10:54:24.000Z",
"value": "VulDB entry last update"
}
],
"title": "aircheng-org iWebShop-5 Login Redirect _userInfo.php redirect",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-112034",
"datePublished": "2026-10-19T00:15:19.433Z",
"dateReserved": "2026-10-18T08:49:04.988Z",
"dateUpdated": "2026-10-19T00:15:19.433Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111931 (GCVE-0-2026-111931)
Vulnerability from cvelistv5 – Published: 2026-10-17 18:46 – Updated: 2026-10-18 11:42
VLAI
EPSS
VEX
Title
Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy
Summary
Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via unsanitized r.URL.Path values. Attackers can craft links on trusted workspace app subdomains with paths beginning with double slashes, which become scheme-relative redirects to attacker sites for phishing.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-18 11:16 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/coder/coder/security/advisorie… | vendor-advisory |
| https://www.vulncheck.com/advisories/coder-2.0.0-… | third-party-advisory |
Impacted products
Date Public
2026-08-10 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111931",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-18T11:16:07.689897Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-18T11:42:56.130Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/coder/coder/v2",
"product": "coder",
"vendor": "coder",
"versions": [
{
"lessThan": "2.34.8",
"status": "affected",
"version": "2.0.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.34.8",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coder:coder:*:*:*:*:*:*:*:*",
"versionEndExcluding": "2.34.8",
"versionStartIncluding": "2.0.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2026-08-10T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via unsanitized r.URL.Path values. Attackers can craft links on trusted workspace app subdomains with paths beginning with double slashes, which become scheme-relative redirects to attacker sites for phishing."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-17T18:46:42.064Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-98qx-9p2x-c4wh)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/coder/coder/security/advisories/GHSA-98qx-9p2x-c4wh"
},
{
"name": "VulnCheck Advisory: Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/coder-2.0.0-before-2.34.8-open-redirect-via-workspace-app-proxy"
}
],
"title": "Coder 2.0.0 before 2.34.8 Open Redirect via Workspace App Proxy",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111931",
"datePublished": "2026-10-17T18:46:42.064Z",
"dateReserved": "2026-10-17T12:20:52.372Z",
"dateUpdated": "2026-10-18T11:42:56.130Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111622 (GCVE-0-2026-111622)
Vulnerability from cvelistv5 – Published: 2026-10-16 17:38 – Updated: 2026-10-16 19:29
VLAI
EPSS
VEX
Title
smart-sso through 2.1.1 OAuth2 Authorization Code Theft via Unvalidated redirectUri
Summary
smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted /login links to users with active SSO sessions, then redeem stolen codes at /oauth2/access_token with any valid client credentials to obtain victims' access tokens.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 19:29 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://hackmd.io/@hieuPenguinnn/smart-sso-oauth2… | third-party-advisory |
| https://github.com/a466350665/smart-sso/blob/2.1.… | technical-description |
| https://github.com/a466350665/smart-sso/blob/1.6.… | technical-description |
| https://github.com/a466350665/smart-sso/blob/1.6.… | technical-description |
| https://github.com/a466350665/smart-sso | product |
| https://www.vulncheck.com/advisories/smart-sso-th… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| a466350665 | smart-sso |
Affected:
0 , ≤ 2.1.1
(custom)
cpe:2.3:a:a466350665:smart-sso:*:*:*:*:*:*:*:* |
Date Public
2026-10-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-111622",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:29:03.823422Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:29:48.555Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://hackmd.io/@hieuPenguinnn/smart-sso-oauth2-code-leak-open-redirect"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:github/a466350665/smart-sso",
"product": "smart-sso",
"repo": "https://github.com/a466350665/smart-sso",
"vendor": "a466350665",
"versions": [
{
"lessThanOrEqual": "2.1.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:a466350665:smart-sso:*:*:*:*:*:*:*:*",
"versionEndIncluding": "2.1.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "hieuPenguinnn"
}
],
"datePublic": "2026-10-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted /login links to users with active SSO sessions, then redeem stolen codes at /oauth2/access_token with any valid client credentials to obtain victims\u0027 access tokens."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:38:58.736Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://hackmd.io/@hieuPenguinnn/smart-sso-oauth2-code-leak-open-redirect"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/a466350665/smart-sso/blob/2.1.1/smart-sso-server/src/main/java/com/smart/sso/server/controller/LoginController.java#L53-L63"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/a466350665/smart-sso/blob/1.6.0/smart-sso-server/src/main/java/openjoe/smart/sso/server/controller/LoginController.java#L50-L59"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/a466350665/smart-sso/blob/1.6.0/smart-sso-server/src/main/java/openjoe/smart/sso/server/controller/Oauth2Controller.java#L55-L84"
},
{
"tags": [
"product"
],
"url": "https://github.com/a466350665/smart-sso"
},
{
"name": "VulnCheck Advisory: smart-sso through 2.1.1 OAuth2 Authorization Code Theft via Unvalidated redirectUri",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/smart-sso-through-2.1.1-oauth2-authorization-code-theft-via-unvalidated-redirecturi"
}
],
"title": "smart-sso through 2.1.1 OAuth2 Authorization Code Theft via Unvalidated redirectUri",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111622",
"datePublished": "2026-10-16T17:38:58.736Z",
"dateReserved": "2026-10-16T14:31:11.006Z",
"dateUpdated": "2026-10-16T19:29:48.555Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111385 (GCVE-0-2026-111385)
Vulnerability from cvelistv5 – Published: 2026-10-16 01:17 – Updated: 2026-10-16 01:17
VLAI
EPSS
VEX
Title
Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools
Summary
Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim's MCP request can redirect file uploads or capture one-time download tokens and replay them to exfiltrate files.
Severity
4.8 (Medium)
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/nezhahq/nezha/security/advisor… | vendor-advisory |
| https://github.com/nezhahq/nezha/commit/36b742a7e… | patch |
| https://github.com/nezhahq/nezha/commit/c72693083… | patch |
| https://www.vulncheck.com/advisories/nezha-2.1.0-… | third-party-advisory |
Impacted products
Date Public
2026-10-01 00:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:golang/github.com/nezhahq/nezha",
"product": "nezha",
"vendor": "nezhahq",
"versions": [
{
"lessThan": "2.3.15",
"status": "affected",
"version": "2.1.0",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "2.3.15",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "manus-use"
}
],
"datePublic": "2026-10-01T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Nezha from 2.1.0 before 2.3.15 contains a host header injection vulnerability in mintTransferTool that builds fs.download_url and fs.upload_url transfer URLs from the unvalidated Host header. Attackers who control the Host header seen on a victim\u0027s MCP request can redirect file uploads or capture one-time download tokens and replay them to exfiltrate files."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T01:17:54.057Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Security Advisory (GHSA-rj3w-jrj7-x7c3)",
"tags": [
"vendor-advisory"
],
"url": "https://github.com/nezhahq/nezha/security/advisories/GHSA-rj3w-jrj7-x7c3"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/nezhahq/nezha/commit/36b742a7e9a81ed782363dd19efd77b7030fbd0f"
},
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/nezhahq/nezha/commit/c726930833937a0aebb2a924064f236faea889f6"
},
{
"name": "VulnCheck Advisory: Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nezha-2.1.0-before-2.3.15-host-header-injection-via-mcp-transfer-tools"
}
],
"title": "Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-111385",
"datePublished": "2026-10-16T01:17:54.057Z",
"dateReserved": "2026-10-15T21:55:44.537Z",
"dateUpdated": "2026-10-16T01:17:54.057Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-109160 (GCVE-0-2026-109160)
Vulnerability from cvelistv5 – Published: 2026-10-13 11:00 – Updated: 2026-10-16 17:17
VLAI
EPSS
VEX
Title
PublicCMS pay Endpoint SafeConfigComponent.java SafeConfigComponent.getSafeUrl redirect
Summary
A vulnerability was determined in PublicCMS up to 5.202608.a. Affected by this issue is the function SafeConfigComponent.getSafeUrl of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java of the component pay Endpoint. Executing a manipulation of the argument returnUrl can lead to open redirect. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:46 UTC
CWE
- CWE-601 - Open Redirect
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/416891 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/416891/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-109160 | third-party-advisory |
| https://vuldb.com/submit/979787 | third-party-advisory |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-109160",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:46:48.724662Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:17:24.257Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:publiccms:publiccms:*:*:*:*:*:*:*:*"
],
"modules": [
"pay Endpoint"
],
"product": "PublicCMS",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "5.202608.a"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "lucasg2g (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in PublicCMS up to 5.202608.a. Affected by this issue is the function SafeConfigComponent.getSafeUrl of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java of the component pay Endpoint. Executing a manipulation of the argument returnUrl can lead to open redirect. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "Open Redirect",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T11:00:14.244Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-416891 | PublicCMS pay Endpoint SafeConfigComponent.java SafeConfigComponent.getSafeUrl redirect",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/416891"
},
{
"name": "VDB-416891 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/416891/cti"
},
{
"name": "CVE-2026-109160 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-109160"
},
{
"name": "Submit #979787 | PublicCMS V5 (V5.202608.a and earlier); V4.0 line also supported open redirect (CWE-601)",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/979787"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-12T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-12T14:15:26.000Z",
"value": "VulDB entry last update"
}
],
"title": "PublicCMS pay Endpoint SafeConfigComponent.java SafeConfigComponent.getSafeUrl redirect",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-109160",
"datePublished": "2026-10-13T11:00:14.244Z",
"dateReserved": "2026-10-12T12:10:20.836Z",
"dateUpdated": "2026-10-16T17:17:24.257Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-108261 (GCVE-0-2026-108261)
Vulnerability from cvelistv5 – Published: 2026-10-09 20:43 – Updated: 2026-10-13 11:24
VLAI
EPSS
VEX
Title
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment
Summary
Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while packages/@tinacms/app/src/lib/preview-origin.ts derives expectedOrigin from that same URL for the GraphQL message channel in packages/@tinacms/app/src/lib/graphql-reducer.ts. An unauthenticated attacker can send a crafted link to a signed-in editor, cause the admin to frame an attacker origin, and have that frame treated as the trusted preview. The attacker-controlled frame can submit GraphQL reads or mutations that the admin executes with the editor credentials, exposing or modifying protected content. This issue is fixed in tinacms 3.14.0 and @tinacms/app 2.5.14.
Severity
9.3 (Critical)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-13 11:22 UTC
CWE
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/tinacms/tinacms/security/advis… | x_refsource_CONFIRM |
| https://github.com/tinacms/tinacms/pull/7522 | x_refsource_MISC |
| https://github.com/tinacms/tinacms/commit/b57dbf4… | x_refsource_MISC |
| https://github.com/tinacms/tinacms/releases/tag/@… | x_refsource_MISC |
| https://github.com/tinacms/tinacms/releases/tag/t… | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-108261",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-13T11:22:22.126132Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-13T11:24:15.591Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-x34j-47hf-4xg7"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "tinacms",
"vendor": "tinacms",
"versions": [
{
"status": "affected",
"version": "\u003c 3.14.0"
}
]
},
{
"product": "app",
"vendor": "@tinacms",
"versions": [
{
"status": "affected",
"version": "\u003c 2.5.14"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /~/* admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while packages/@tinacms/app/src/lib/preview-origin.ts derives expectedOrigin from that same URL for the GraphQL message channel in packages/@tinacms/app/src/lib/graphql-reducer.ts. An unauthenticated attacker can send a crafted link to a signed-in editor, cause the admin to frame an attacker origin, and have that frame treated as the trusted preview. The attacker-controlled frame can submit GraphQL reads or mutations that the admin executes with the editor credentials, exposing or modifying protected content. This issue is fixed in tinacms 3.14.0 and @tinacms/app 2.5.14."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-346",
"description": "CWE-346: Origin Validation Error",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-441",
"description": "CWE-441: Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-09T20:43:37.580Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/tinacms/tinacms/security/advisories/GHSA-x34j-47hf-4xg7",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/tinacms/tinacms/security/advisories/GHSA-x34j-47hf-4xg7"
},
{
"name": "https://github.com/tinacms/tinacms/pull/7522",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tinacms/tinacms/pull/7522"
},
{
"name": "https://github.com/tinacms/tinacms/commit/b57dbf4b56201aef15cd92caa49fd12ab96bbecf",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tinacms/tinacms/commit/b57dbf4b56201aef15cd92caa49fd12ab96bbecf"
},
{
"name": "https://github.com/tinacms/tinacms/releases/tag/@tinacms/app@2.5.14",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tinacms/tinacms/releases/tag/@tinacms/app@2.5.14"
},
{
"name": "https://github.com/tinacms/tinacms/releases/tag/tinacms@3.14.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/tinacms/tinacms/releases/tag/tinacms@3.14.0"
}
],
"source": {
"advisory": "GHSA-x34j-47hf-4xg7",
"discovery": "UNKNOWN"
},
"title": "TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-108261",
"datePublished": "2026-10-09T20:43:37.580Z",
"dateReserved": "2026-10-09T17:33:15.410Z",
"dateUpdated": "2026-10-13T11:24:15.591Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-107718 (GCVE-0-2026-107718)
Vulnerability from cvelistv5 – Published: 2026-10-08 21:39 – Updated: 2026-10-14 01:24
VLAI
EPSS
VEX
Title
AdonisJS: Unencoded route parameters can produce open redirects
Summary
AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl() and Response.redirect().toRoute(). If an application places attacker-controlled data in a dynamic first path segment and uses the generated route URL as a redirect destination, a value beginning with a slash can produce a scheme-relative external URL. Wildcard parameters are affected by the same missing encoding, while APIs intentionally accepting complete redirect URLs are not affected. An attacker can redirect users from a trusted application to an attacker-controlled site, facilitating phishing or abuse of authentication and OAuth flows. This issue is fixed in versions 8.2.3 and 9.3.0.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-14 01:24 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/adonisjs/http-server/security/… | x_refsource_CONFIRM |
| https://github.com/adonisjs/http-server/commit/45… | x_refsource_MISC |
| https://github.com/adonisjs/http-server/commit/ab… | x_refsource_MISC |
| https://github.com/adonisjs/http-server/releases/… | x_refsource_MISC |
| https://github.com/adonisjs/http-server/releases/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| adonisjs | http-server |
Affected:
< 8.2.3
Affected: >= 9.0.0, < 9.3.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-107718",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-14T01:24:04.422529Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-14T01:24:14.635Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "http-server",
"vendor": "adonisjs",
"versions": [
{
"status": "affected",
"version": "\u003c 8.2.3"
},
{
"status": "affected",
"version": "\u003e= 9.0.0, \u003c 9.3.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inserts route parameter values into URLs without encodeURIComponent in the shared createURL() helper used by Router.makeUrl() and Response.redirect().toRoute(). If an application places attacker-controlled data in a dynamic first path segment and uses the generated route URL as a redirect destination, a value beginning with a slash can produce a scheme-relative external URL. Wildcard parameters are affected by the same missing encoding, while APIs intentionally accepting complete redirect URLs are not affected. An attacker can redirect users from a trusted application to an attacker-controlled site, facilitating phishing or abuse of authentication and OAuth flows. This issue is fixed in versions 8.2.3 and 9.3.0."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-08T21:39:54.474Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/adonisjs/http-server/security/advisories/GHSA-2m6q-8v3h-jqww",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/adonisjs/http-server/security/advisories/GHSA-2m6q-8v3h-jqww"
},
{
"name": "https://github.com/adonisjs/http-server/commit/4548a0631ce2ef1618f04c7b41465be42cad2f7d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/adonisjs/http-server/commit/4548a0631ce2ef1618f04c7b41465be42cad2f7d"
},
{
"name": "https://github.com/adonisjs/http-server/commit/ab607a2958327b6f0019d38f26081e431768877a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/adonisjs/http-server/commit/ab607a2958327b6f0019d38f26081e431768877a"
},
{
"name": "https://github.com/adonisjs/http-server/releases/tag/v8.2.3",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/adonisjs/http-server/releases/tag/v8.2.3"
},
{
"name": "https://github.com/adonisjs/http-server/releases/tag/v9.3.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/adonisjs/http-server/releases/tag/v9.3.0"
}
],
"source": {
"advisory": "GHSA-2m6q-8v3h-jqww",
"discovery": "UNKNOWN"
},
"title": "AdonisJS: Unencoded route parameters can produce open redirects"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-107718",
"datePublished": "2026-10-08T21:39:54.474Z",
"dateReserved": "2026-10-08T17:21:52.975Z",
"dateUpdated": "2026-10-14T01:24:14.635Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105846 (GCVE-0-2026-105846)
Vulnerability from cvelistv5 – Published: 2026-10-06 16:01 – Updated: 2026-10-06 17:39
VLAI
EPSS
VEX
Title
Payload: Untrusted redirect URL parameter exploit
Summary
Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after the authentication flow completes. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 17:34 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/payloadcms/payload/security/ad… | x_refsource_CONFIRM |
| https://github.com/payloadcms/payload/commit/a742… | x_refsource_MISC |
| https://github.com/payloadcms/payload/releases/ta… | x_refsource_MISC |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| payloadcms | payload |
Affected:
>= 3.40.0, < 3.88.0
Affected: >= 4.0.0-canary.0, < 4.0.0-canary.27 |
|
| @payloadcms | next |
Affected:
>= 3.31.0, < 3.88.0
Affected: >= 4.0.0-canary.0, < 4.0.0-canary.27 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105846",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T17:34:11.494178Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T17:39:36.818Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "payload",
"vendor": "payloadcms",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.40.0, \u003c 3.88.0"
},
{
"status": "affected",
"version": "\u003e= 4.0.0-canary.0, \u003c 4.0.0-canary.27"
}
]
},
{
"product": "next",
"vendor": "@payloadcms",
"versions": [
{
"status": "affected",
"version": "\u003e= 3.31.0, \u003c 3.88.0"
},
{
"status": "affected",
"version": "\u003e= 4.0.0-canary.0, \u003c 4.0.0-canary.27"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after the authentication flow completes. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T16:01:30.370Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/payloadcms/payload/security/advisories/GHSA-w84c-53h3-mc2g",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/payloadcms/payload/security/advisories/GHSA-w84c-53h3-mc2g"
},
{
"name": "https://github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a"
},
{
"name": "https://github.com/payloadcms/payload/releases/tag/v3.88.0",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/payloadcms/payload/releases/tag/v3.88.0"
}
],
"source": {
"advisory": "GHSA-w84c-53h3-mc2g",
"discovery": "UNKNOWN"
},
"title": "Payload: Untrusted redirect URL parameter exploit"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-105846",
"datePublished": "2026-10-06T16:01:30.370Z",
"dateReserved": "2026-10-05T23:06:29.747Z",
"dateUpdated": "2026-10-06T17:39:36.818Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation MIT-5
Implementation
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- Use a list of approved URLs or domains to be used for redirection.
Mitigation
Architecture and Design
Use an intermediate disclaimer page that provides the user with a clear warning that they are leaving the current site. Implement a long timeout before the redirect occurs, or force the user to click on the link. Be careful to avoid XSS problems (CWE-79) when generating the disclaimer page.
Mitigation MIT-21.2
Architecture and Design
Strategy: Enforcement by Conversion
- When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
- For example, ID 1 could map to "/login.asp" and ID 2 could map to "http://www.example.com/". Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.
Mitigation
Architecture and Design
Ensure that no externally-supplied requests are honored by requiring that all redirect requests include a unique nonce generated by the application [REF-483]. Be sure that the nonce is not predictable (CWE-330).
Mitigation MIT-6
Architecture and Design
Implementation
Strategy: Attack Surface Reduction
- Understand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly through API calls.
- Many open redirect problems occur because the programmer assumed that certain inputs could not be modified, such as cookies and hidden form fields.
Mitigation MIT-29
Operation
Strategy: Firewall
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
CAPEC-178: Cross-Site Flashing
An attacker is able to trick the victim into executing a Flash document that passes commands or calls to a Flash player browser plugin, allowing the attacker to exploit native Flash functionality in the client browser. This attack pattern occurs where an attacker can provide a crafted link to a Flash document (SWF file) which, when followed, will cause additional malicious instructions to be executed. The attacker does not need to serve or control the Flash document. The attack takes advantage of the fact that Flash files can reference external URLs. If variables that serve as URLs that the Flash application references can be controlled through parameters, then by creating a link that includes values for those parameters, an attacker can cause arbitrary content to be referenced and possibly executed by the targeted Flash application.