Miniorange vulnerabilities, page 4

93 vulnerabilities

Known vulnerabilities in Miniorange products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 54 products.

7.4HighCVE-2026-5343drupal · saml sso - service provider +1 moreSAML SSO - Service Provider - Critical - Authentication bypass - SA-CONTRIB-2026-031Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal SAML SSO - Service Provider allows Privilege Escalation. This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.4.EPSS0.34%9.8CriticalCVE-2026-28148miniorange · headless single sign on +1 moreWordPress Headless Single Sign On plugin <= 1.6 - Bypass Vulnerability vulnerabilityUnauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions.EPSS0.34%9.8CriticalCVE-2026-28149miniorange · headless single sign on +1 moreWordPress Headless Single Sign On plugin <= 1.6 - PHP Object Injection vulnerabilityUnauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.EPSS0.56%9.8CriticalCVE-2026-28008miniorange · oauth single sign on – sso (oauth client) +1 moreWordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.0.0 - Broken Authentication vulnerabilityUnauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions.EPSS0.61%5.3MediumCVE-2026-81205drupal · ldap / active directory integration +1 moreLDAP / Active Directory Integration - Moderately critical - Information Disclosure - SA-CONTRIB-2026-115Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1.EPSS0.33%4.3MediumCVE-2026-97267miniorange · prevent_files_\/_folders_access +1 moreWordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Control vulnerabilitySubscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.EPSS0.21%9.8CriticalCVE-2026-97274miniorange · oauth single sign on – sso (oauth client) +1 moreWordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.2 - Bypass vulnerability vulnerabilityUnauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions.EPSS0.30%6.1MediumCVE-2026-3217drupal · saml sso - service provider +1 moreSAML SSO - Service Provider - Critical - Cross-site scripting - SA-CONTRIB-2026-018Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS).This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.3.EPSS0.26%7.2HighCVE-2026-82229miniorange · wordpress social login and register +1 moreWordPress WordPress Social Login and Register plugin <= 7.8.2 - Cross Site Scripting (XSS) vulnerabilityUnauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.2 versions.EPSS0.25%7.2HighCVE-2023-2484cyberlord92 · active directory integration / ldap integration +2 moreActive Directory Integration / LDAP Integration <= 4.1.4 - Authenticated (Administrator+) SQL InjectionThe Active Directory Integration plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 4.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.EPSS0.85%6.5MediumCVE-2023-2599cyberlord92 · active directory integration / ldap integration +2 moreActive Directory Integration / LDAP Integration <= 4.1.4 - Cross-Site Request Forgery to SQL InjectionThe Active Directory Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 4.1.4 due to missing nonce verification on the get_users function and insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to cause resource exhaustion via a forged request granted they can trick an administrator into performing an action such as clicking on a link.EPSS0.42%9.8CriticalCVE-2023-2982cyberlord92 · miniorange social login and register (discord, google, twitter, linkedin) +2 moreWordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.6.4 - Authentication BypassThe WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the email address associated with that user. This was partially patched in version 7.6.4 and fully patched in version 7.6.5.EPSS46.24%5.3MediumCVE-2023-52176miniorange · malware_scanner +1 moreWordPress Malware Scanner plugin <= 4.7.1 - IP Restriction Bypass vulnerabilityAuthentication Bypass by Spoofing vulnerability in miniorange Malware Scanner allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Malware Scanner: from n/a through 4.7.1.EPSS0.40%6.5MediumCVE-2023-1093miniorange · oauth_single_sign_on +2 moreOAuth Single Sign On - SSO (OAuth Client) < 6.24.2 - IdP Discard via CSRFThe OAuth Single Sign On WordPress plugin before 6.24.2 does not have CSRF checks when discarding Identify providers (IdP), which could allow attackers to make logged in admins delete all IdP via a CSRF attackEPSS0.33%6.5MediumCVE-2023-1092miniorange · oauth_single_sign_on +5 moreOAuth Single Sign On - SSO (OAuth Client) - IdP Deletion via CSRFThe OAuth Single Sign On Free WordPress plugin before 6.24.2, OAuth Single Sign On Standard WordPress plugin before 28.4.9, OAuth Single Sign On Premium WordPress plugin before 38.4.9 and OAuth Single Sign On Enterprise WordPress plugin before 48.4.9 do not have CSRF checks when deleting Identity Providers (IdP), which could allow attackers to make logged in admins delete arbitrary IdP via a CSRF attackEPSS0.44%4.3MediumCVE-2023-41873miniorange · saml_sp_single_sign_on +1 moreWordPress SAML Single Sign On – SSO Login plugin <= 5.0.4 - Broken Access Control vulnerabilityMissing Authorization vulnerability in miniOrange SAML SP Single Sign On allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SAML SP Single Sign On: from n/a through 5.0.4.EPSS0.50%8.8HighCVE-2023-47683miniorange · wordpress_social_login_and_register_\(discord\,_google\,_twitter\,_linkedin\) +1 moreWordPress Social Login, Social Sharing by miniOrange plugin <= 7.6.6 - Authenticated Privilege Escalation vulnerabilityImproper Privilege Management vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) allows Privilege Escalation.This issue affects WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn): from n/a through 7.6.6.EPSS0.48%4.3MediumCVE-2023-47776miniorange · miniorange otp verification +1 moreWordPress miniorange otp verification plugin <= 4.2.1 - Broken Access Control vulnerabilityMissing Authorization vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects miniorange otp verification: from n/a through <= 4.2.1.EPSS0.34%7.5HighCVE-2023-0812miniorange · active_directory_integration_\/_ldap_integration +2 moreActive Directory Integration / LDAP Integration < 4.1.1 - Unauthenticated Data DisclosureThe Active Directory Integration / LDAP Integration WordPress plugin before 4.1.1 does not have proper authorization or nonce values for some POST requests, leading to unauthenticated data disclosure.EPSS0.82%4.9MediumCVE-2023-4505cyberlord92 · staff/employee business directory for active directory +2 moreStaff / Employee Business Directory for Active Directory <= 1.2.3 - Authenticated (Admin+) LDAP PassbackThe Staff / Employee Business Directory for Active Directory plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 1.2.3. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated attackers, with administrative access and above, to change the LDAP server and retrieve the credentials for the original LDAP server.EPSS0.91%