CVE-2026-94102— WuzhiCMS Login index.php redirect
Quick assessment
Affected
n/a WuzhiCMS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 WuzhiCMS 4.1.0 及更早版本中发现了一个漏洞。该漏洞影响组件 Login 中文件 的某个未知功能。通过操纵参数 ，攻击者可引发开放重定向（Open Redirect）问题。该攻击可远程发起。相关的利用方法（exploit）已公开，并可能被用于实际攻击。目前系统仅使用 进行过滤，该函数是一个专门用于清除 XSS 关键字/实体的清理器。供应商在漏洞披露初期已被联系，但未以任何方式作出回应。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-94102
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WuzhiCMS Login index.php redirect
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw has been found in WuzhiCMS up to 4.1.0. This affects an unknown function of the file /index.php?m=member&v=Login of the component Login. This manipulation of the argument forward causes open redirect. The attack can be initiated remotely. The exploit has been published and may be used. The only sanitization is remove_xss(), an XSS keyword/entity scrubber. The vendor was contacted early about this disclosure but did not respond in any way.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | WuzhiCMS | 4.0 |
cpe:2.3:a:wuzhicms:wuzhicms:*:*:*:*:*:*:*:*
|
|
II. Public POCs for CVE-2026-94102
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-94102
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-94102 (1)
Same Patch Batch · n/a · 2026-09-21 · 3 CVEs total
| CVE-2026-94110 | 7.3 HIGH | QCMS Content Detail Controllers.php self_Tmp sql injection |
| CVE-2026-94103 | 4.7 MEDIUM | RooCMS Frontend Rendering site_pagePHP.php eval code injection |
IV. Related Vulnerabilities
Same product: WuzhiCMS
-
CVE-2026-92380
WuzhiCMS Remote Image Fetch index.php saveRemote server-side -
CVE-2026-91849
WuzhiCMS Avatar Upload index.php setAvatar unrestricted uplo -
CVE-2026-91848
WuzhiCMS index.php getDataOfJson sql injection -
CVE-2026-15530
WuzhiCMS Attachment API index.php listimage information disc -
CVE-2025-3563
WuzhiCMS Setting index.php set code injection
Same vendor: n/a
-
CVE-2026-94110
QCMS Content Detail Controllers.php self_Tmp sql injection -
CVE-2026-94103
RooCMS Frontend Rendering site_pagePHP.php eval code injecti -
CVE-2026-94094
OpenClaw Canvas Host Route server.ts createCanvasHostHandler -
CVE-2026-94043
Free5GC Gmm handler.go race condition -
CVE-2026-94030
SerenityOS LibGfx BMPLoader.cpp decode_bmp_pixel_data intege
Same weakness: CWE-601
-
CVE-2026-7527
WP Ghost (Hide My WP Ghost) <= 7.0.02 - Unauthenticated Open -
CVE-2026-93871
Cotonti through 1.0.0 Stored Open Redirect via Page redir: P -
CVE-2026-93869
Cotonti through 1.0.0 Open Redirect via Unanchored cot_url_c -
CVE-2026-77386
Kyoo: OIDC login token can be redirected to an attacker-cont -
CVE-2026-77609
Semantic MediaWiki has an open redirect in Special:URIResolv
V. Comments for CVE-2026-94102
No comments yet