Weaknesses of type CWE-601

1,291 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2024-1227MEDIUMMultiple vulnerabilities in Rejetto's Http File ServerEPSS 0.5%CVE-2026-55590MEDIUMCakePHP: Open redirect weakness via backslash bypassEPSS 0.5%CVE-2025-68602MEDIUMWordPress Accept Donations with PayPal plugin <= 1.5.2 - Open Redirection vulnerabilityEPSS 0.5%CVE-2023-25829MEDIUMBUG-000155001 - Unvalidated redirect in Portal for ArcGIS.EPSS 0.5%CVE-2024-31135MEDIUMIn JetBrains TeamCity before 2024.03 open redirect was possible on the login pageEPSS 0.5%CVE-2022-41275MEDIUMIn SAP Solution Manager (Enterprise Search) - versions 740, and 750, an unauthenticated attacker can generate a link that, if clicked by a lEPSS 0.5%CVE-2026-28681HIGHIRRd: web UI host header injection allows password reset poisoning via attacker-controlled email linksEPSS 0.5%CVE-2025-8066MEDIUMBunker Web 1.6.2 - Uncontrolled external site redirectEPSS 0.5%CVE-2023-3515LOWOpen Redirect in go-gitea/giteaEPSS 0.5%CVE-2026-92216MEDIUMa2ui-project a2ui Binder generic-binder.ts openUrl redirectEPSS 0.5%CVE-2021-22526MEDIUMOpen Redirection vulnerability in NetIQ Access Manager versions prior to version 4.5.4 and 5.0.1EPSS 0.5%CVE-2024-46326MEDIUMPublic Knowledge Project pkp-lib 3.4.0-7 and earlier is vulnerable to Open redirect due to a lack of input sanitization in the logout functiEPSS 0.5%CVE-2023-6552MEDIUMOpen redirect in TasmoAdminEPSS 0.5%CVE-2026-121373MEDIUMSymfony: HtmlSanitizer MetaRefreshAttributeSanitizer Matches Only a Narrow Subset of the Browser Refresh Grammar (Incomplete Fix for CVE-2026-48761)EPSS 0.5%CVE-2024-0545MEDIUMCodeCanyon RISE Ultimate Project Manager signin redirectEPSS 0.5%CVE-2021-34763MEDIUMCisco Firepower Management Center Software Cross-Site Scripting and Open Redirect VulnerabilitiesEPSS 0.5%CVE-2026-17291HIGHMultiple Vulnerabilities in IBM API ConnectEPSS 0.5%CVE-2023-41648MEDIUMWordPress Login and Logout Redirect Plugin <= 2.0.3 is vulnerable to Open RedirectionEPSS 0.5%CVE-2023-45105MEDIUMWordPress affiliate-toolkit – WordPress Affiliate Plugin Plugin <= 3.3.9 is vulnerable to Open RedirectionEPSS 0.5%CVE-2015-10052MEDIUMcalesanz gibb-modul-151 login redirectEPSS 0.5%