CVE-2019-11016: Open Redirect Vulnerability | Qualys

Summary: Qualys Web Application Scanning researchers discovered and reported an open redirect vulnerability, CVE-2019-11016, in the Elgg framework, which the Elgg team promptly fixed. Versions before 1.12.18 and 2.3.x versions before 2.3.11 are vulnerable via the $url parameter, and Elgg used the value of the "Referer" header to redirect to the next page.
What you should know: An attacker can craft a link that appears benign and redirects users seamlessly to a phishing site, and the flaw becomes more dangerous when combined with phishing or cross-site scripting.

Read the original at Qualys Blog ↗

Topics: Supply Chain & AppSec
Mentions: CVE-2019-11016
Related: Kitesurf is now open source Cyber Risks · Nov 13, 2026
Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026
ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026