Weaknesses of type CWE-601

1,296 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2026-60641HIGHVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are EPSS 0.3%CVE-2025-21104MEDIUMDell NetWorker, versions prior to 19.11.0.4 and version 19.12, contains an URL Redirection to Untrusted Site ('Open Redirect') VulnerabilityEPSS 0.3%CVE-2026-35102MEDIUMHCL AION is affected by multiple security vulnerabilities.EPSS 0.3%CVE-2026-25779MEDIUMGitea redirect handling permits open redirects through backslash pathsEPSS 0.3%CVE-2026-11477MEDIUMhs-web hsweb-framework OAuth2 Client OAuth2Client.java OAuth2Client redirectEPSS 0.3%CVE-2023-23855MEDIUMSAP Solution Manager - version 720, allows an authenticated attacker to redirect users to a malicious site due to insufficient URL validatioEPSS 0.3%CVE-2025-14451MEDIUMSolutions Ad Manager <= 1.0.0 - Unauthenticated Open Redirect via 'sam-redirect-to' ParameterEPSS 0.3%CVE-2025-5183MEDIUMSummer Pearl Group Vacation Rental Management Platform Header redirectEPSS 0.3%CVE-2026-0484MEDIUMMissing Authorization check in SAP NetWeaver Application Server ABAP and SAP S/4HANAEPSS 0.3%CVE-2022-46886MEDIUMThere exists an open redirect within the response list update functionality of ServiceNow. This allows attackers to redirect users to arbitrEPSS 0.3%CVE-2026-2709MEDIUMbusy Callback app.js redirectEPSS 0.3%CVE-2026-59180LOWApprise forwards configured auth headers across cross-origin HTTP redirectsEPSS 0.3%CVE-2026-13277MEDIUMSecurity vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify AccessEPSS 0.3%CVE-2026-41226MEDIUMOpen redirect vulnerability exists in Multiple laser printers and MFPs which implement Ricoh Web Image Monitor. When accessing a specially cEPSS 0.3%CVE-2023-22641MEDIUMA url redirection to untrusted site ('open redirect') in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.9, EPSS 0.3%CVE-2024-37141LOWDell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an open redirect vulnerability. A remote low EPSS 0.3%CVE-2026-53662CRITICALimmich: One-click account takeover via XSS in login page continue redirectEPSS 0.3%CVE-2024-46481HIGHThe login page of Venki Supravizio BPM up to 18.1.1 is vulnerable to open redirect leading to reflected XSS.EPSS 0.3%CVE-2023-51675MEDIUMWordPress Advanced Access Manager Plugin <= 6.9.18 is vulnerable to Open RedirectionEPSS 0.3%CVE-2026-81423MEDIUMAccept Stripe Payments < 2.1.4 - Open Redirect via IPN HandlerEPSS 0.3%