CVE-2026-94102

Name of the Vulnerable Software and Affected Versions WuzhiCMS versions prior to 4.1.1

Description A flaw in the Login component allows for an open redirect, which occurs when a user is unexpectedly redirected to an external site. This issue is triggered by the manipulation of the forward argument within the '/index.php?m=member&v=Login' endpoint. The system only employs remove xss(), a function designed to scrub XSS keywords and entities, which is insufficient to prevent this redirection.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the forward argument in the '/index.php?m=member&v=Login' endpoint until the issue is resolved.