CVE-2026-94102
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk34th percentile - higher than 34% of all known CVEs
Summary
A flaw was found in WuzhiCMS up to 4.1.0 in /index.php?m=member&v=Login (Login component). Manipulation of the forward argument causes open redirect. The attack can be initiated remotely and the exploit has been published.
Risk Assessment
A remote attacker can redirect users to malicious sites, facilitating phishing and credential theft. The only sanitization is remove_xss(), which does not prevent open redirect.
Recommendation
Update WuzhiCMS beyond 4.1.0 or apply vendor patches; until then, validate the forward parameter server-side.
Other vulnerabilities in WuzhiCMS
See all- CVE-2026-92380High
WuzhiCMS up to 4.1.0 has an SSRF vulnerability in the ckditor::saveRemote function in coreframe/app/attachment/index.php (Remote Image Fetch component). Manipulation of source[] parameter leads to server-side request forgery.
- CVE-2026-88419High
An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint (/index.php?m=member&f=article&v=thumbUpload) of WuzhiCMS 5.0.0 allows an authenticated low-privileged member to upload a crafted .php file and execute arbitrary PHP code on the server.
- CVE-2026-91849Medium
A security flaw has been discovered in WuzhiCMS up to 4.1.0. This affects the function member::setAvatar of the file /index.php?m=member&f=user&v=setAvatar of the Avatar Upload component. The manipulation of the argument File results in unrestricted upload.
- CVE-2026-91848High
A vulnerability was identified in WuzhiCMS up to 4.1.0 in the article::getDataOfJson function of /index.php?m=content&f=article&v=getDataOfJson. Manipulation of the title/master_table arguments leads to SQL injection. The exploit is publicly available and can be used remotely.
- CVE-2026-15530Medium
A vulnerability has been found in WuzhiCMS up to version 4.1.0 in the Attachment API component. The config/listimage function in the file /index.php?m=attachment&f=index&v=upload allows manipulation leading to information disclosure. The attack can be performed remotely and an exploit has been published.
- CVE-2024-32206Medium
In WUZHICMS v4.1.0, a stored XSS vulnerability exists in the /affiche/admin/index.php component. Attackers can inject arbitrary scripts or HTML via the $formdata parameter.
Original NVD description (English source)
A flaw has been found in WuzhiCMS up to 4.1.0. This affects an unknown function of the file /index.php?m=member&v=Login of the component Login. This manipulation of the argument forward causes open redirect. The attack can be initiated remotely. The exploit has been published and may be used. The only sanitization is remove_xss(), an XSS keyword/entity scrubber. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS