Security Advisory

CVE-2026-28413

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-03-05 20:16:10

Last updated 2026-03-06 17:03:20

Assigner GitHub_M

CVSS score 5.3

State PUBLISHED

Description

Products.isurlinportal is a replacement for isURLInPortal method in Plone. Prior to versions 2.1.0, 3.1.0, and 4.0.0, a url /login?came_from=////evil.example may redirect to an external website after login. This issue has been patched in versions 2.1.0, 3.1.0, and 4.0.0.

← Browse all CVEs View on cve.org ↗