Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-109160: PublicCMS pay endpoint can redirect users to any site
CVE-2026-109160 · published 5 days ago
Summary
The pay feature in PublicCMS versions up to 5.202608.a lets attackers change the return URL parameter, causing the system to send users to a malicious website. This open redirect can be triggered remotely and may be used for phishing or other attacks. Update PublicCMS to a patched version or apply the vendor’s recommended fix to validate return URLs.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| – | publiccms | 5.202608.a |
Original advisory text
PublicCMS pay Endpoint SafeConfigComponent.java SafeConfigComponent.getSafeUrl redirect
A vulnerability was determined in PublicCMS up to 5.202608.a. Affected by this issue is the function SafeConfigComponent.getSafeUrl of the file publiccms-core/src/main/java/com/publiccms/logic/component/config/SafeConfigComponent.java of the component pay Endpoint. Executing a manipulation of the argument returnUrl can lead to open redirect. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-601Open Redirect
Timeline
Published13 Oct 2026
Updated17 Oct 2026
First seen13 Oct 2026
Track software like this
Free during beta