Weaknesses of type CWE-601

1,296 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2026-60632CRITICALVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are EPSS 0.4%CVE-2022-38662MEDIUMHCL Digital Experience is susceptible to open redirectsEPSS 0.4%CVE-2026-10545HIGHIBM Planning Analytics Local is affected by Open RedirectEPSS 0.4%CVE-2023-47779MEDIUMWordPress Integration for Contact Form 7 and Constant Contact Plugin <= 1.1.4 is vulnerable to Open RedirectionEPSS 0.4%CVE-2026-12049MEDIUMpgAdmin 4: Open redirect in multi-factor authentication flow via unvalidated 'next' parameterEPSS 0.4%CVE-2024-32129MEDIUMWordPress Freshdesk (official) plugin <= 2.3.6 - Open Redirection vulnerabilityEPSS 0.4%CVE-2026-91296HIGHVulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versEPSS 0.4%CVE-2024-33930MEDIUMWordPress Share This Image plugin <= 1.97 - Open Redirection vulnerabilityEPSS 0.4%CVE-2026-34931HIGHhoppscotch: Improper loopback redirect_uri validation in device-login flowEPSS 0.4%CVE-2021-25655MEDIUMURL redirection to untrusted site possible in Avaya Aura Experience PortalEPSS 0.4%CVE-2025-2824HIGHIBM Operational Decision Manager HTTP open redirectEPSS 0.4%CVE-2024-11207MEDIUMApereo CAS login redirectEPSS 0.4%CVE-2026-101152HIGHSecurity Advisory 0187EPSS 0.4%CVE-2026-59717MEDIUMHome Assistant Companion: `homeassistant://invite` Deep Link Credential PhishingEPSS 0.4%CVE-2025-53535LOWBetter Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple RoutesEPSS 0.4%CVE-2024-20400MEDIUMA vulnerability in the web-based management interface of Cisco Expressway Series could allow an unauthenticated, remote attacker to redirectEPSS 0.4%CVE-2026-80327MEDIUMOpen Redirect in PingGateway Fragment FilterEPSS 0.4%CVE-2024-0854MEDIUMURL redirection to untrusted site ('Open Redirect') vulnerability in file access component in Synology DiskStation Manager (DSM) before 6.2.EPSS 0.4%CVE-2023-32517MEDIUMWordPress MailChimp Subscribe Forms Plugin <= 4.0.9.3 is vulnerable to Open RedirectionEPSS 0.4%CVE-2023-32101MEDIUMWordPress Library Viewer Plugin <= 2.0.6 is vulnerable to Open RedirectionEPSS 0.4%