Miniorange vulnerabilities
93 vulnerabilities
Known vulnerabilities in Miniorange products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 53 products.
Products
50 of 53- Active Directory Integration \/ Ldap Integration6 vulnerabilities
- Google Authenticator6 vulnerabilities
- Miniorange 2Fa6 vulnerabilities
- Wordpress Social Login And Register \(Discord\, Google\, Twitter\, Linkedin\)6 vulnerabilities
- Miniorange Otp Verification5 vulnerabilities
- Saml Sp Single Sign On5 vulnerabilities
- Wordpress Social Login And Register5 vulnerabilities
- Oauth Single Sign On4 vulnerabilities
- Headless Single Sign On3 vulnerabilities
- Malware Scanner3 vulnerabilities
- Oauth Single Sign On – SSO (Oauth Client)3 vulnerabilities
- Prevent Files \/ Folders Access3 vulnerabilities
- WP Oauth Server3 vulnerabilities
- Custom API For WP2 vulnerabilities
- Miniorange Discord Integration2 vulnerabilities
- Otp Verification With Firebase2 vulnerabilities
- Page Restriction2 vulnerabilities
- Saml2 vulnerabilities
- Saml Sso Service Provider2 vulnerabilities
- Staff \/ Employee Business Directory For Active Directory2 vulnerabilities
- Web3 Crypto Wallet Login \& Nft Token Gating2 vulnerabilities
- Wordpress Rest Api Authentication2 vulnerabilities
- Backup And Restore1 vulnerabilities
- Discord Integration1 vulnerabilities
- JWT Authentication For WP REST Apis1 vulnerabilities
- Ldap \/ Active Directory Integration1 vulnerabilities
- Ldap Integration With Active Directory And Openldap1 vulnerabilities
- LDAP Integration With Active Directory And Openldap NTLM & Kerberos Login1 vulnerabilities
- Limit Login Attempts1 vulnerabilities
- Login Using Wordpress Users1 vulnerabilities
- Login With Cognito1 vulnerabilities
- Login With Otp Over Sms\, Email\, Whatsapp And Google Authenticator1 vulnerabilities
- Miniorange Wordpress SAML SSO Premium1 vulnerabilities
- Miniorange Wordpress SAML SSO Premium Mulsitesite1 vulnerabilities
- Miniorange Wordpress SAML SSO Standard1 vulnerabilities
- Miniorange'S Google Authenticator1 vulnerabilities
- Miniorange'S Google Authenticator – Wordpress Two Factor Authentication – 2FA , Two Factor, OTP SMS And Email | Passwordless Login1 vulnerabilities
- Miniorange'S Google Authenticator (Wordpress Plugin)1 vulnerabilities
- Oauth \& Openid Connect Single Sign On1 vulnerabilities
- Oauth 2.0 Client For Sso1 vulnerabilities
- Oauth 2.0 Client For SSO (Wordpress Plugin)1 vulnerabilities
- Oauth Single Sign On Enterprise1 vulnerabilities
- Oauth Single Sign On Free1 vulnerabilities
- Oauth Single Sign On Premium1 vulnerabilities
- Oauth Single Sign On Standard1 vulnerabilities
- Password Policy Manager1 vulnerabilities
- Social Login1 vulnerabilities
- Web Application Firewall1 vulnerabilities
- Wordpress REST API Authentication (Wordpress Plugin)1 vulnerabilities
- Wordpress Security1 vulnerabilities
CVE-2026-107433miniorangewp oauth server
EPSS score0.27%
Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP OAuth Server: from n/a through 6.4.0.CVE-2021-47979miniorangebackup and restore+1EPSS score0.40%
WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating parameters in AJAX requests. Attackers can send POST requests to admin-ajax.php with crafted file_name and folder_name parameters to delete arbitrary files from the WordPress installation directory.CVE-2021-36786miniorangesamlEPSS score1.00%
The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows Sensitive Data Exposure of API credentials and private keys.CVE-2021-36785miniorangesamlEPSS score0.50%
The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows XSS.CVE-2025-54048miniorangecustom api for wp+1EPSS score0.42%
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in miniOrange Custom API for WP custom-api-for-wp allows SQL Injection.This issue affects Custom API for WP: from n/a through <= 4.2.2.CVE-2025-54049miniorangecustom api for wp+1EPSS score0.41%
Incorrect Privilege Assignment vulnerability in miniOrange Custom API for WP custom-api-for-wp allows Privilege Escalation.This issue affects Custom API for WP: from n/a through <= 4.2.2.CVE-2025-54745miniorangeminiorange's google authenticator+1EPSS score0.32%
Missing Authorization vulnerability in miniOrange miniOrange's Google Authenticator miniorange-2-factor-authentication allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects miniOrange's Google Authenticator: from n/a through <= 6.1.1.CVE-2025-68974miniorangewordpress social login and register+1EPSS score0.48%
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange WordPress Social Login and Register miniorange-login-openid allows PHP Local File Inclusion.This issue affects WordPress Social Login and Register: from n/a through <= 7.7.0.CVE-2025-47670miniorangewordpress social login and register+1EPSS score0.66%
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange WordPress Social Login and Register miniorange-login-openid allows PHP Local File Inclusion.This issue affects WordPress Social Login and Register: from n/a through <= 7.6.10.CVE-2025-47672miniorangeminiorange discord integration+1EPSS score0.66%
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange miniOrange Discord Integration miniorange-discord-integration allows PHP Local File Inclusion.This issue affects miniOrange Discord Integration: from n/a through <= 2.2.2.CVE-2025-47707drupalenterprise mfa - tfa for drupal+1EPSS score0.42%
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.CVE-2025-47709drupalenterprise mfa - tfa for drupal+1EPSS score0.25%
Missing Authorization vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Forceful Browsing.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.CVE-2025-47710drupalenterprise mfa - tfa for drupal+1EPSS score0.39%
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.CVE-2025-47706drupalenterprise mfa - tfa for drupal+1EPSS score0.28%
Authentication Bypass by Capture-replay vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Remote Services with Stolen Credentials.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.CVE-2025-47708drupalenterprise mfa - tfa for drupal+1EPSS score0.20%
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Cross Site Request Forgery.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.CVE-2025-31019miniorangepassword policy manager+1EPSS score0.58%
Authentication Bypass Using an Alternate Path or Channel vulnerability in miniOrange Password Policy Manager password-policy-manager allows Authentication Abuse.This issue affects Password Policy Manager: from n/a through <= 2.0.4.CVE-2025-39545miniorangewordpress_rest_api_authentication+1EPSS score0.52%
Missing Authorization vulnerability in miniOrange WordPress REST API Authentication wp-rest-api-authentication allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress REST API Authentication: from n/a through <= 3.6.3.CVE-2025-53561miniorangeprevent_files_\/_folders_access+1EPSS score0.43%
Path Traversal: '.../...//' vulnerability in miniOrange Prevent files / folders access prevent-file-access allows Path Traversal.This issue affects Prevent files / folders access: from n/a through <= 2.6.0.CVE-2025-6675drupalenterprise mfa - tfa for drupal+1EPSS score0.24%
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.8.0, from 5.2.0 before 5.2.1, from 0.0.0 before 5.0.*, from 0.0.0 before 5.1.*.CVE-2020-6850miniorangesaml_sp_single_sign_on+1EPSS score1.38%
Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables, and the Destination parameter of the samlp:Response XML element.