Vulnerabilidades de Miniorange
CVEs publicadas que afetam produtos de Miniorange: 9 registro(s), com severidade, exploração e correções.
Saml Sso - Service Provider 2Miniorange Otp Verification 2miniOrange's Google Authenticator 1WordPress Social Login and Register 1Backup and Restore 1WP OAuth Server 1Ldap / Active Directory Integration 1
CVE-2026-107433
Média · 6.5
CWE-862 14/10/2026
WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP OAuth Server: from n/a through 6.4.0.
CVE-2026-106610
Crítica · 9.8
CWE-266 10/10/2026
WordPress miniorange otp verification plugin <= 5.5.7 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7.
CVE-2026-81205
Média · 5.3
CWE-90 02/09/2026
LDAP Injection em Miniorange Ldap / Active Directory Integration
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1.
CVE-2026-5343
Alta · 7.4
CWE-754 28/05/2026
SAML SSO - Service Provider - Critical - Authentication bypass - SA-CONTRIB-2026-031
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal SAML SSO - Service Provider allows Privilege Escalation.
This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.4.
CVE-2026-42731
Crítica · 9.8
CWE-266 27/05/2026
Plugin miniOrange OTP Verification - Escalonamento de Privilégios
Vulnerabilidade de Atribuição Incorreta de Privilégios em miniOrange miniorange otp verification miniorange-otp-verification permite Escalonamento de Privilégios.Esta questão afeta miniorange otp verification: de n/a até <= 5.4.9.
CVE-2021-47979
Alta · 8.8
CWE-22 16/05/2026
WordPress Plugin Backup and Restore 1.0.3 Arbitrary File Deletion
WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating parameters in AJAX requests. Attackers can send POST requests to admin-ajax.php with crafted file_name and folder_name parameters to delete arbitrary files from the WordPress installation directory.
CVE-2026-3217
Média · 6.1
CWE-79 25/03/2026
SAML SSO - Service Provider - Critical - Cross-site scripting - SA-CONTRIB-2026-018
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS).This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.3.
CVE-2025-68974
Média · 6.6
CWE-98 30/12/2025
WordPress WordPress Social Login and Register plugin <= 7.7.0 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange WordPress Social Login and Register miniorange-login-openid allows PHP Local File Inclusion.This issue affects WordPress Social Login and Register: from n/a through <= 7.7.0.
CVE-2025-54745
Média · 6.5
CWE-862 18/12/2025
WordPress miniOrange's Google Authenticator Plugin <= 6.1.1 - Broken Access Control Vulnerability
Missing Authorization vulnerability in miniOrange miniOrange's Google Authenticator miniorange-2-factor-authentication allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects miniOrange's Google Authenticator: from n/a through <= 6.1.1.