CVE Intelligence

Miniorange vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Miniorange products: 9 record(s), with severity, exploitation and fixes.

Saml Sso - Service Provider 2Miniorange Otp Verification 2miniOrange's Google Authenticator 1WordPress Social Login and Register 1Backup and Restore 1WP OAuth Server 1Ldap / Active Directory Integration 1

Exploited only (KEV) →

CVE-2026-107433 Medium · 6.5 CWE-862 Oct 14, 2026
WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP OAuth Server: from n/a through 6.4.0.
CVE-2026-106610 Critical · 9.8 CWE-266 Oct 10, 2026
WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7.
CVE-2026-81205 Medium · 5.3 CWE-90 Sep 2, 2026
LDAP Injection in Miniorange Ldap / Active Directory Integration
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1.
CVE-2026-5343 High · 7.4 CWE-754 May 28, 2026
SAML SSO - Service Provider - Critical - Authentication bypass - SA-CONTRIB-2026-031
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal SAML SSO - Service Provider allows Privilege Escalation. This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.4.
CVE-2026-42731 Critical · 9.8 CWE-266 May 27, 2026
miniOrange OTP Verification Plugin - Privilege Escalation
Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through <= 5.4.9.
CVE-2021-47979 High · 8.8 CWE-22 May 16, 2026
WordPress Plugin Backup and Restore 1.0.3 Arbitrary File Deletion
WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating parameters in AJAX requests. Attackers can send POST requests to admin-ajax.php with crafted file_name and folder_name parameters to delete arbitrary files from the WordPress installation directory.
CVE-2026-3217 Medium · 6.1 CWE-79 Mar 25, 2026
SAML SSO - Service Provider - Critical - Cross-site scripting - SA-CONTRIB-2026-018
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS).This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.3.
CVE-2025-68974 Medium · 6.6 CWE-98 Dec 30, 2025
WordPress WordPress Social Login and Register plugin <= 7.7.0 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange WordPress Social Login and Register miniorange-login-openid allows PHP Local File Inclusion.This issue affects WordPress Social Login and Register: from n/a through <= 7.7.0.
CVE-2025-54745 Medium · 6.5 CWE-862 Dec 18, 2025
WordPress miniOrange's Google Authenticator Plugin <= 6.1.1 - Broken Access Control Vulnerability
Missing Authorization vulnerability in miniOrange miniOrange's Google Authenticator miniorange-2-factor-authentication allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects miniOrange's Google Authenticator: from n/a through <= 6.1.1.