Weaknesses of type CWE-601

1,296 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2025-31871MEDIUMWordPress WP Clone any post type Plugin <= 3.6 - Open Redirect vulnerabilityEPSS 0.4%CVE-2026-89307MEDIUMHTML injection allows open redirection in WordPress theme design-scuole-wordpress-themeEPSS 0.4%CVE-2023-2000MEDIUMUnrestricted navigation due to unvalidated mattermost server redirectionEPSS 0.4%CVE-2025-64101HIGHZITADEL Vulnerable to Account Takeover via Malicious Forwarded Header InjectionEPSS 0.4%CVE-2023-31237MEDIUMWordPress Zephyr Project Manager Plugin <= 3.3.9 is vulnerable to Open RedirectionEPSS 0.4%CVE-2026-56326MEDIUMNuxt - Server-Side Open Redirect via Path-Normalization Bypass in navigateToEPSS 0.4%CVE-2022-27861MEDIUMWordPress Ninja Popups Plugin <= 4.7.5 is vulnerable to Open RedirectionEPSS 0.4%CVE-2022-36028CRITICALBigBlueButton Greenlight Open Redirect vulnerabilityEPSS 0.4%CVE-2023-31095MEDIUMWordPress Integration for Contact Form 7 HubSpot Plugin <= 1.2.8 is vulnerable to Open RedirectionEPSS 0.4%CVE-2026-79650MEDIUMApache CXF: OIDC RP Open RedirectEPSS 0.4%CVE-2025-32694MEDIUMWordPress Ultimate WP Mail plugin <= 1.3.10 - Open Redirection vulnerabilityEPSS 0.4%CVE-2025-50477MEDIUMA URL redirection in lbry-desktop v0.53.9 allows attackers to redirect victim users to attacker-controlled pages.EPSS 0.4%CVE-2026-22912MEDIUMImproper validation of a login parameter may allow attackers to redirect users to malicious websites after authentication. This can lead to EPSS 0.4%CVE-2024-22244MEDIUMHarbor Open Redirect URLEPSS 0.4%CVE-2026-80200MEDIUMKimai before 2.53.0 Open Redirect via RelayStateEPSS 0.4%CVE-2026-93869MEDIUMCotonti through 1.0.0 Open Redirect via Unanchored cot_url_check() RegexEPSS 0.4%CVE-2025-2697HIGHIBM Cognos Command Center HTTP Open RedirectEPSS 0.4%CVE-2022-44560MEDIUMThe launcher module has an Intent redirection vulnerability. Successful exploitation of this vulnerability may cause launcher module data toEPSS 0.4%CVE-2024-7428MEDIUMPotential Open Redirect issues affect OpenText™ Network Node Manager i (NNMi).EPSS 0.4%CVE-2024-12561MEDIUMAffiliate Sales in Google Analytics and other tools <= 2.0.0 - Open RedirectEPSS 0.4%