Read the docs

miniOrange

Records129All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical28CVSS 9.0–10.0
CVSS high39CVSS 7.0–8.9

Exploited now

miniOrange records in CISA KEV

No miniOrange vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Active Directory Integration / Ldap Integration 6 records HIGH Google Authenticator 6 records MEDIUM Miniorange 2fa 6 records LOW Oauth Single Sign On 4 records HIGH Saml Sp Single Sign On 3 records LOW Wordpress Social Login And Register (discord, Google, Twitter, Linkedin) 3 records HIGH Malware Scanner 2 records LOW Otp Verification With Firebase 2 records MEDIUM

Records

6 records in Miniorange 2fa · all components

TI-2025-30205 CVE-2025-47708 · GHSA-p3vf-h5cf-xmjr

Enterprise MFA - TFA for Drupal - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-054

Priority LOW 39

Cross-Site Request Forgery (CSRF) vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Cross Site Request Forgery.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5…

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00201 Published 2025-05-14 Fixed in 4.7.0, 5.2.0 CWE-352
TI-2025-30207 CVE-2025-47710 · GHSA-h8vr-q495-8mwj

Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-056

Priority LOW 35

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, f…

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00389 Published 2025-05-14 Fixed in 4.7.0, 5.2.0 CWE-288
TI-2025-30206 CVE-2025-47709 · GHSA-mqhr-6wmj-4wqg

Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-055

Priority LOW 34

Missing Authorization vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Forceful Browsing.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00253 Published 2025-05-14 Fixed in 4.7.0, 5.2.0 CWE-862
TI-2025-30204 CVE-2025-47707 · GHSA-p24g-cj72-gpfv

Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-053

Priority LOW 33

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, f…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00424 Published 2025-05-14 Fixed in 4.7.0, 5.2.0 CWE-288
TI-2025-06062 CVE-2025-6675 · GHSA-9c75-x9m5-346w

Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-082

Priority LOW 24

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.8.0, f…

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00235 Published 2025-06-26 Fixed in 4.8.0, 5.2.1 CWE-288
TI-2025-30203 CVE-2025-47706 · GHSA-pwfh-8xv9-vgc2

Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-052

Priority LOW 22

Authentication Bypass by Capture-replay vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Remote Services with Stolen Credentials.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0,…

CVSS 3.1MEDIUM 4.8 Network No auth No interaction EPSS 0.00282 Published 2025-05-14 Fixed in 4.7.0, 5.2.0 CWE-294
Open these records in search →