Weaknesses of type CWE-601

1,295 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2023-45203MEDIUMOnline Examination System v1.0 - Multiple Open RedirectsEPSS 0.5%CVE-2023-45202MEDIUMOnline Examination System v1.0 - Multiple Open RedirectsEPSS 0.5%CVE-2024-8761HIGHShare This Image <= 2.03 - Open Redirect via link ParameterEPSS 0.5%CVE-2026-101907HIGHAxios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRFEPSS 0.5%CVE-2026-44427NONEMCP Registry: Open RedirectEPSS 0.5%CVE-2023-38481MEDIUMWordPress Integration for WooCommerce and Zoho CRM Plugin < 1.3.7 is vulnerable to Open RedirectionEPSS 0.5%CVE-2023-20264MEDIUMA vulnerability in the implementation of Security Assertion Markup Language (SAML) 2.0 single sign-on (SSO) for remote access VPN in Cisco AEPSS 0.5%CVE-2023-40602MEDIUMWordPress Doofinder for WooCommerce Plugin <= 1.5.49 is vulnerable to Open RedirectionEPSS 0.5%CVE-2023-38478MEDIUMWordPress Integration for WooCommerce and QuickBooks Plugin <= 1.2.3 is vulnerable to Open RedirectionEPSS 0.5%CVE-2023-35029MEDIUMOpen redirect vulnerability in the Layout module's SEO configuration in Liferay Portal 7.4.3.70 through 7.4.3.76, and Liferay DXP 7.4 updateEPSS 0.5%CVE-2024-26504HIGHAn issue in Wifire Hotspot v.4.5.3 allows a local attacker to execute arbitrary code via a crafted payload to the dst parameter.EPSS 0.5%CVE-2026-44745HIGHOpen Redirect vulnerability in SAP ApprouterEPSS 0.5%CVE-2025-4513MEDIUMCatalyst User Key Authentication Plugin Logout logout.php redirectEPSS 0.5%CVE-2022-45413MEDIUMUsing the <code>S.browser_fallback_url parameter</code> parameter, an attacker could redirect a user to a URL and cause SameSite=Strict cookEPSS 0.5%CVE-2024-28344LOWAn Open Redirect vulnerability was found in Sipwise C5 NGCP Dashboard below mr11.5.1. The Open Redirect vulnerability allows attackers to coEPSS 0.5%CVE-2026-54072CRITICALAuthorizer: Unvalidated redirect_uri in /authorize leaks OAuth2 tokens to attacker-controlled URLEPSS 0.5%CVE-2024-11274HIGHURL Redirection to Untrusted Site ('Open Redirect') in GitLabEPSS 0.5%CVE-2022-41207MEDIUMSAP Biller Direct allows an unauthenticated attacker to craft a legitimate looking URL. When clicked by an unsuspecting victim, it will use EPSS 0.5%CVE-2026-59730LOW@astrojs/node: Backslash-prefixed paths not recognized as internal by trailing-slash redirectEPSS 0.5%CVE-2020-21038MEDIUMOpen redirect vulnerability in typecho 1.1-17.10.30-release via the referer parameter to Login.php.EPSS 0.5%