JumpServer - Open Redirect via Referer Header

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses the Referer header as the redirection target without proper validation, which could lead to an Open Redirect vulnerability. id:...

ZZcms - Cross-Site Scripting

ZZcms 2019 contains a cross-site scripting vulnerability in the user login page. An attacker can inject arbitrary JavaScript code in the referer header via user/login.php, which can allow theft of cookie-based credentials and launch of subsequent attacks. id: CVE-2020-20285 info: name: ZZcms -...

cve-2018-11714_POC

cve-2018-11714POC An issue was discovered on TP-Link TL-WR840N. This issue is caused by improper session handling on the /cgi/ folder or a /cgi file. If an attacker sends a header of "Referer: http://192.168.0.1/mainFrame.htm" then no authentication is required for any action. artigo pt-br:...

CVE-2023-43326

mooSocial: XSS CVE-2023-43326 A reflected cross-site scripting XSS vulnerability exisits in multiple url of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. Note: XXS Also works when these URLs are used in Referer Header. The...

CVE-2025-69985

CVE-2025-69985: Exploit for Authentication Bypass to RCE in FUXA ≤1.2.8 📌 General Description This repository contains a Proof of Concept PoC and detailed technical documentation about the vulnerability CVE-2025-69985 , which affects FUXA versions ≤1.2.8. The vulnerability allows an unauthenticat...

YesWiki cross-site scripting vulnerability

Versions of YesWiki prior to 4.7.0 contain a cross-site scripting vulnerability. This flaw arises because handlers/page/referrerssites.php fails to escape HTML meta-characters within the Referer header, potentially enabling stored cross-site scripting attacks. Unauthenticated attackers can inject...

CVE-2026-116824 YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler

YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrerssites.php that allows unauthenticated attackers to inject scripts via crafted Referer headers. Attackers can send a Referer hostname containing HTML metacharacters that renders unescaped, executing...

CVE-2026-116824 YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler

YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrerssites.php that allows unauthenticated attackers to inject scripts via crafted Referer headers. Attackers can send a Referer hostname containing HTML metacharacters that renders unescaped, executing...

CVE-2026-116824

Versions of YesWiki prior to 4.7.0 are vulnerable to a stored cross-site scripting (XSS) flaw in the handlers/page/referrers_sites.php component. The root cause is the failure to properly escape HTML metacharacters within the Referer header . This allows unauthenticated attackers to inject malici...

CVE-2026-116824 YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler

YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrerssites.php that allows unauthenticated attackers to inject scripts via crafted Referer headers. Attackers can send a Referer hostname containing HTML metacharacters that renders unescaped, executing...

boneIO Black cross-site request forgery vulnerability

In boneIO Black versions 1.2.0 through 1.6.0, there is a cross-site request forgery vulnerability. This vulnerability arises because all API endpoints that modify state lack CSRF tokens and do not validate the Origin or Referer headers. As a result, remote attackers can craft malicious web pages...

CVE-2021-48016

DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary...

EUVD-2021-34899

DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary...

CVE-2021-48016

DedeCMS (through version 5.8.1-beta ) is vulnerable to a PHP code injection vulnerability within the ShowMsg() function. The flaw exists because the HTTP Referer header is written into a DedeTemplate string and subsequently included by the application. Unauthenticated attackers can exploit this b...

CVE-2021-48016 DedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php

DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary...

Microsoft SharePoint Server - Authentication Bypass (ToolShell)

Microsoft Office SharePoint Server contains an improper authentication vulnerability that allows unauthorized attackers to perform spoofing over a network. By crafting a POST request to /layouts/15/ToolPane.aspx with a forged Referer header /layouts/SignOut.aspx, attackers can bypass authenticati...

VulnCheck KEV: CVE-2021-48016

DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary...

CVE-2021-48016: Improper Control of Generation of Code

DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary...

PT-2026-116363

Name of the Vulnerable Software and Affected Versions User Registration & Membership versions prior to 5.2.9 Description Insufficient input sanitization in the referrer url branch of the UR Smart Tags::process function allows unauthenticated attackers to execute arbitrary registered shortcodes. T...

CVE-2026-87111

The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Referer Header in all versions up to, and including, 6.2.9 due to insufficient input sanitization and output escaping. Thi...