Unrated
views/auth.go in Orange Forum 1.4.0 allows Open Redirection via the next parameter to /login or /signup.
CVE-2018-14474
First seen on SecPulse
References
- patch github.com