A flaw in the WuzhiCMS login component allows an attacker to manipulate the forward argument in the URL to perform an open redirect. The redirect can send a user to a malicious site, enabling phishing or drive‑by compromise. The available sanitization only removes XSS keywords, which does not prevent the redirect logic. This weakness leads to confidentiality and integrity risks for unsuspecting users. The vulnerability is present in WuzhiCMS up to and including version 4.1.0 and affects the /index.php?m=member&v=Login entry point. No patch was issued by the vendor, and the file contains an obscure function that processes the forward parameter. The CVSS score of 5.3 reflects a moderate severity. The EPSS score is not available and the issue is not listed in CISA’s KEV catalog, indicating no known widespread exploitation at this time. The attack can be carried out remotely by sending specially crafted requests to the vulnerable URL—this is the likely attack vector.

The flaw affects WuzhiCMS versions up to and including 4.1.0. The vulnerability resides in the login page (/index.php?m=member&v=Login) of the WuzhiCMS component. No other vendors are listed in the CNA data.

The vulnerability has a CVSS score of 5.3, indicating moderate severity. The EPSS score is not available and the issue is not listed in CISA's KEV catalog, suggesting no known widespread exploitation. The attacker can remotely trigger the open‑redirect by sending a crafted request to the vulnerable URL; the forward parameter is processed without proper validation, so the redirect can be directed to an arbitrary external site.