Weaknesses of type CWE-601

1,185 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2026-33868MEDIUMMastodon has a GET-Based Open Redirect via '/web/%2F<domain>'EPSS 0.5%CVE-2024-8761HIGHShare This Image <= 2.03 - Open Redirect via link ParameterEPSS 0.5%CVE-2023-38481MEDIUMWordPress Integration for WooCommerce and Zoho CRM Plugin < 1.3.7 is vulnerable to Open RedirectionEPSS 0.5%CVE-2023-40602MEDIUMWordPress Doofinder for WooCommerce Plugin <= 1.5.49 is vulnerable to Open RedirectionEPSS 0.5%CVE-2022-44488LOWAEM URL Redirection to Untrusted Site Security feature bypassEPSS 0.5%CVE-2026-53437MEDIUMJenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to JenkinsEPSS 0.5%CVE-2023-38478MEDIUMWordPress Integration for WooCommerce and QuickBooks Plugin <= 1.2.3 is vulnerable to Open RedirectionEPSS 0.5%CVE-2023-35029MEDIUMOpen redirect vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 updateEPSS 0.5%CVE-2022-41273MEDIUMDue to improper input sanitization in SAP Sourcing and SAP Contract Lifecycle Management - version 1100, an attacker can redirect a user to EPSS 0.5%CVE-2024-26504HIGHAn issue in Wifire Hotspot v.4.5.3 allows a local attacker to execute arbitrary code via a crafted payload to the dst parameter.EPSS 0.5%CVE-2026-44745HIGHOpen Redirect vulnerability in SAP ApprouterEPSS 0.5%CVE-2026-33506HIGHDOM-Based XSS in Ory Polis Login PageEPSS 0.5%CVE-2024-28344LOWAn Open Redirect vulnerability was found in Sipwise C5 NGCP Dashboard below mr11.5.1. The Open Redirect vulnerability allows attackers to coEPSS 0.5%CVE-2024-11274HIGHURL Redirection to Untrusted Site ('Open Redirect') in GitLabEPSS 0.5%CVE-2022-41215MEDIUMSAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URLEPSS 0.5%CVE-2025-57800HIGHAudiobookshelf vulnerable to OIDC token exfiltration and account takeoverEPSS 0.5%CVE-2020-21038MEDIUMOpen redirect vulnerability in typecho 1.1-17.10.30-release via the referer parameter to Login.php.EPSS 0.5%CVE-2025-14692MEDIUMMayan EDMS authentication redirectEPSS 0.5%CVE-2024-9266MEDIUMOpen RedirectEPSS 0.5%CVE-2026-1296MEDIUMFrontend Post Submission Manager Lite <= 1.2.7 - Unauthenticated Open Redirect via 'requested_page' ParameterEPSS 0.5%