Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Products.isurlinportal is a replacement for isURLInPortal method in Plone. Prior to versions 2.1.0, 3.1.0, and 4.0.0, a url /login?came_from=////evil.example may redirect to an external website after login. This issue has been patched in versions 2.1.0, 3.1.0, and 4.0.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
CVE-2026-28413 Products.isurlinportal is a replacement for isURLInPortal method in Plone. Prior to versions 2.1.0, 3.1.0, and 4.0.0, a url /login?came_from=////evil.example may redi… https://www.cve.org/CVERecord?id=CVE-2026-28413
Post summary
CVE-2026-28413 is a vulnerability in Plone’s Products.isurlinportal where manipulating the /login?came_from parameter can result in a redirect, affecting versions before 2.1.0, 3.1.0, and 4.0.0.
CVE-2026-28413 Open Redirect Vulnerability in Products.isurlinportal Before 2.1.0, 3.1.0, and 4.0.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28413
Post summary
The post announces CVE-2026-28413, an open redirect flaw in Products.isurlinportal versions before 2.1.0, 3.1.0, and 4.0.0, but offers no proof‑of‑concept, exploitation details, or remediation information.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | plone | isurlinportal | - | plone | - |
| App | plone | isurlinportal | 4.0.0 | plone | - |