PT-2025-31207 · Undefined · Undefined

A remote code execution vulnerability exists in HybridAuth versions 2.0.9 through 2.2.2 due to insecure use of the install.php installation script. The script remains accessible after deployment and fails to sanitize input before writing to the application’s config.php file. An unauthenticated...

Hybridauth 安全漏洞

Hybridauth is a web-based authentication and authorization software from Hybridauth open source. A security vulnerability exists in Hybridauth versions 2.0.9 through 2.2.2, which stems from an install.php script that does not properly clean up its inputs, which could lead to remote code execution...

CVE-2014-125116

creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/hybridauthinstallphpexec.rb 2025-10-23 21:12:57+00:00| seen| MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7...

Multiple vulnerabilities in Drupal HybridAuth Social Login module

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.HybridAuth Social Login is one of the modules that uses social network accounts to log in and register with the Drupal system. An information disclosure and open redirection vulnerabili...

HybridAuth - Less critical - Multiple vulnerabilities - SA-CONTRIB-2016-018

The HybridAuth Social Login module enables you to allow visitors to authenticate or login to a Drupal site using their identities from social networks like Facebook or Twitter. Open redirect The module doesn't verify the "destination" redirect after a login to be a non-external URL causing an ope...

CVE-2015-5511

The HybridAuth Social Login module 7.x-2.x before 7.x-2.13 for Drupal allows remote attackers to bypass the user registration by administrator only configuration and create an account via a social login...

Authentication flaw

The HybridAuth Social Login module 7.x-2.x before 7.x-2.13 for Drupal allows remote attackers to bypass the user registration by administrator only configuration and create an account via a social login...

CVE-2015-5511

The HybridAuth Social Login module 7.x-2.x before 7.x-2.13 for Drupal allows remote attackers to bypass the user registration by administrator only configuration and create an account via a social login...

CVE-2015-5511

The vulnerability CVE-2015-5511 affects the HybridAuth Social Login module for Drupal 7.x-2.x, specifically versions prior to 7.x-2.13. The issue allows remote attackers to bypass the site’s “administrator only” user registration configuration and create accounts via social login. The root cause ...

CodoForum 3.3.1 Cross Site Scripting

CodoForum 3.3.1 Multiple Cross Site Scriptings Security Advisory – Curesec Research Team Online-Reference http://blog.curesec.com/article/blog/CodoForum-331-Multiple-Cross-Site-Scripting-Vulnerabilities-40.html 1. Introduction Affected Product: CodoForum 3.3.1 Fixed in: 3.4 Fixed Version Link:...

Drupal HybridAuth Social Login Module Security Bypass Vulnerability

Drupal is a free and open source content management system developed in PHP.HybridAuth Social Login is one of the modules that uses social network accounts to log in and register with the Drupal system. A security vulnerability exists in the Drupal HybridAuth Social Login module that could be...

HybridAuth Social Login - Less Critical - Access bypass - SA-CONTRIB-2015-127

The HybridAuth Social Login module enables you to allow visitors to authenticate or login to a Drupal site using their identities from social networks like Facebook or Twitter. The module allows account creation through social login when the configuration is set to allow user registration by...

CVE-2015-4395

The HybridAuth Social Login module 7.x-2.x before 7.x-2.10 for Drupal stores passwords in plaintext when the "Ask user for a password when registering" option is enabled, which allows remote authenticated users with certain permissions to obtain sensitive information by leveraging access to the...

Design/Logic Flaw

The HybridAuth Social Login module 7.x-2.x before 7.x-2.10 for Drupal stores passwords in plaintext when the "Ask user for a password when registering" option is enabled, which allows remote authenticated users with certain permissions to obtain sensitive information by leveraging access to the...

CVE-2015-4395

The HybridAuth Social Login module 7.x-2.x before 7.x-2.10 for Drupal stores passwords in plaintext when the "Ask user for a password when registering" option is enabled, which allows remote authenticated users with certain permissions to obtain sensitive information by leveraging access to the...

CVE-2015-4395

The CVE-2015-4395 affects the HybridAuth Social Login module for Drupal (7.x-2.x) prior to 7.x-2.10. The underlying issue is that when the option “Ask user for a password when registering” is enabled, passwords are stored in plaintext, allowing remote authenticated users with certain permissions ...

Drupal HybridAuth Social Login Module Information Disclosure Vulnerability

Drupal is a free and open source content management system developed in PHP.HybridAuth Social Login is one of the modules that uses social network accounts to log in and register with the Drupal system. An information disclosure vulnerability exists in Drupal HybridAuth Social Login, which can be...

HybridAuth Social Login - Less Critical - Information Disclosure - SA-CONTRIB-2015-097

HybridAuth Social Login module enables you to allow visitors to authenticate or login to a Drupal site using their identities from social networks like Facebook or Twitter. The module may store user passwords in plain text. This vulnerability is mitigated by the fact that the option "Ask user for...

HybridAuth 2.2.2 /hybridauth/config.php 命令执行漏洞

No description provided by source...

HybridAuth <= 2.2.2 'install.php' RCE Vulnerability

HybridAuth is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...