PT-2026-59594

When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came from' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially craft...

CVE-2026-28413 Products.isurlinportal: Possible open redirect when using more than 2 forward slashes

Products.isurlinportal is a replacement for isURLInPortal method in Plone. Prior to versions 2.1.0, 3.1.0, and 4.0.0, a url /login?camefrom=////evil.example may redirect to an external website after login. This issue has been patched in versions 2.1.0, 3.1.0, and 4.0.0...

GHSA-43GX-6GV6-3JCP Products.isurlinportal has possible open redirect when using more than 2 forward slashes

Impact A url /login?camefrom=////evil.example may redirect to an external website after login. Standard Plone is not affected, but if you have customised the login, for example with add-ons, you might be affected. You can try the url to check if you are affected or not. Patches The problem has be...

PT-2018-5246

Name of the Vulnerable Software and Affected Versions Plone versions 2.5 through 5.1rc1 Description The issue allows an attacker to potentially trick users into accessing malicious sites or executing attacker-controlled JavaScript after logging in, by exploiting the redirect mechanism that uses t...

PT-2017-9088

Name of the Vulnerable Software and Affected Versions Plone CMS versions 3.3.x through 3.3.6 Plone CMS versions 4.x through 4.3.11 Plone CMS versions 5.x through 5.0.6 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This can be...

PT-2015-6832

Name of the Vulnerable Software and Affected Versions Kallithea versions prior to 0.3 Description The issue allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the came from parameter to the admin/login API endpoint. Recommendations For version...

PT-2014-7121

Name of the Vulnerable Software and Affected Versions Zenoss Core versions prior to 4.2.5 SP161 Description The issue concerns an open redirect vulnerability in the login form. This allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the came from...

PT-2014-5475

Name of the Vulnerable Software and Affected Versions Zenoss version 4.2.5 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks. This is achieved via a URL in the came from parameter in the /zport/acl users/cookieAuthHelper/login form...