CVE-2015-5354

Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to admin/nos/login.

• CWE-601

• http://hyp3rlinx.altervista.org/advisories/AS-NOVIUSOS0629.txtThird Party Advisory
• http://packetstormsecurity.com/files/132478/Novius-OS-5.0.1-elche-XSS-LFI-Open-Redirect.htmlExploit, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/535876/100/0/threadedThird Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/37439/Third Party Advisory, VDB Entry
• http://hyp3rlinx.altervista.org/advisories/AS-NOVIUSOS0629.txtThird Party Advisory
• http://packetstormsecurity.com/files/132478/Novius-OS-5.0.1-elche-XSS-LFI-Open-Redirect.htmlExploit, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/archive/1/535876/100/0/threadedThird Party Advisory, VDB Entry
• https://www.exploit-db.com/exploits/37439/Third Party Advisory, VDB Entry

Published

Jul 1, 2015

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-5348Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and…
• CVE-2015-5349The CSV export in Apache LDAP Studio and Apache Directory St…
• CVE-2015-5350In Garden versions 0.22.0-0.329.0, a vulnerability has been …
• CVE-2015-5351The (1) Manager and (2) Host Manager applications in Apache …
• CVE-2015-5352The x11_open_helper function in channels.c in ssh in OpenSSH…
• CVE-2015-5353Directory traversal vulnerability in Novius OS 5.0.1 (Elche)…
• CVE-2015-5355Multiple cross-site scripting (XSS) vulnerabilities in GetSi…
• CVE-2015-5356Cross-site scripting (XSS) vulnerability in admin/filebrowse…
• CVE-2015-5357The Juniper EX4600, QFX3500, QFX3600, and QFX5100 switches w…
• CVE-2015-5358Juniper Junos OS 12.1X44 before 12.1X44-D50, 12.1X46 before …
• CVE-2015-5359Juniper Junos OS 12.1X44 before 12.1X44-D50, 12.1X46 before …
• CVE-2015-5360IPv6 sendd in Juniper Junos 12.1X44 before 12.1X44-D51, 12.1…