Weaknesses of type CWE-601

1,272 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2026-35302HIGHVulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 12.EPSS 0.3%CVE-2024-47646MEDIUMWordPress Payflex Payment Gateway plugin <= 2.6.1 - Open Redirection vulnerabilityEPSS 0.3%CVE-2024-3597HIGHExport WP Page to Static HTML/CSS <= 2.2.2 - Open RedirectEPSS 0.3%CVE-2026-82467MEDIUMRodauth before 2.47.0 Open Redirect via Return-to PathEPSS 0.3%CVE-2026-86756MEDIUMSnipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayStateEPSS 0.3%CVE-2024-31282MEDIUMWordPress App Builder plugin <= 3.8.7 - Open Redirection vulnerabilityEPSS 0.3%CVE-2024-47354MEDIUMWordPress Simple Membership After Login Redirection plugin <= 1.6 - Open Redirection vulnerabilityEPSS 0.3%CVE-2025-55624MEDIUMAn intent redirection vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access internal functions or access non-pEPSS 0.3%CVE-2023-50963MEDIUMIBM Storage Defender HTTP HOST header injectionEPSS 0.3%CVE-2025-10229MEDIUMFreshwork logout redirectEPSS 0.3%CVE-2026-60467HIGHVulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affectedEPSS 0.3%CVE-2024-54728MEDIUMIncorrect access control in BYD QIN PLUS DM-i Dilink OS 3.0_13.1.7.2204050.1 allows unauthorized attackers to access system logcat logs.EPSS 0.3%CVE-2023-0681MEDIUMRapid7 Nexpose Uncontrolled URL RedirectEPSS 0.3%CVE-2025-4143MEDIUMMissing validation of redirect_uri on authorize endpointEPSS 0.3%CVE-2022-44560MEDIUMThe launcher module has an Intent redirection vulnerability. Successful exploitation of this vulnerability may cause launcher module data toEPSS 0.3%CVE-2025-39404MEDIUMWordPress Sassy Social Share plugin <= 3.3.73 - Open Redirection vulnerabilityEPSS 0.3%CVE-2026-40332MEDIUMMasa CMS open redirect via improper handling of scheme-relative URLsEPSS 0.3%CVE-2024-56960MEDIUMAn issue in Tianjin Xiaowu Information technology Co., Ltd BeiKe Holdings iOS 1.3.50 allows attackers to access sensitive user information vEPSS 0.3%CVE-2024-25676MEDIUMAn issue was discovered in ViewerJS 0.5.8. A script from the component loads content via URL TAGs without properly sanitizing it. This leadsEPSS 0.3%CVE-2018-25245HIGH7 Tik 1.0.1.0 Denial of Service via SearchEPSS 0.3%