Weaknesses of type CWE-601

1,187 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2026-3318MEDIUMMultiple vulnerabilities in Cradle e-commerceEPSS 0.3%CVE-2026-67362MEDIUMJoomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5EPSS 0.3%CVE-2026-42259MEDIUMSaltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass)EPSS 0.3%CVE-2026-40299MEDIUMnext-intl has an open redirect vulnerabilityEPSS 0.3%CVE-2026-55806MEDIUMDrupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007EPSS 0.3%CVE-2026-54770MEDIUMWebOb: Open redirect in Location header normalization via leading C0 control / space charactersEPSS 0.3%CVE-2024-23442MEDIUMKibana open redirect issueEPSS 0.3%CVE-2024-41801MEDIUMOpenProject packaged installation has Open Redirect Vulnerability in Sign-In in default configurationEPSS 0.3%CVE-2026-56697MEDIUMNuxt - Open Redirect via Protocol-Relative Paths in reloadNuxtAppEPSS 0.3%CVE-2024-32078MEDIUMWordPress FV Player plugin <= 7.5.44.7212 - Unvalidated Redirects and Forwards vulnerabilityEPSS 0.3%CVE-2026-95813MEDIUMe621ng before 26.09.16 Open Redirect via URL ParametersEPSS 0.3%CVE-2026-94216MEDIUMST Engineering iDirect Evolution/Velocity WebServer Evolution HTTP Header webserver authorize redirectEPSS 0.3%CVE-2026-55431HIGHCoder's session token leaked to arbitrary hosts via `coder open app` for external workspace appsEPSS 0.3%CVE-2024-51321HIGHIn Zucchetti Ad Hoc Infinity 2.4, an improper check on the m_cURL parameter allows an attacker to redirect the victim to an attacker-controlEPSS 0.3%CVE-2026-94214MEDIUMST Engineering iDirect Evolution/Velocity WebServer Evolution Management Service login.html redirectEPSS 0.3%CVE-2026-48856HIGHhttpc leaks Authorization header to cross-origin redirect targetsEPSS 0.3%CVE-2023-32218MEDIUMAvaya IX Workforce Engagement - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')EPSS 0.3%CVE-2026-12071MEDIUMTeamDavid: Header Injection leading to Open Redirect via URL-encoded charactersEPSS 0.3%CVE-2024-7941MEDIUMAn HTTP parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By modifying theEPSS 0.3%CVE-2024-12990MEDIUMruifang-tech Rebuild Admin Verification Page admin-verify redirectEPSS 0.3%