Weaknesses of type CWE-601

1,296 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2022-44717LOWAn issue was discovered in NetScout nGeniusONE 6.3.2 build 904. Open Redirection can occur (issue 1 of 2). After successful login, an attackEPSS 0.3%CVE-2022-38657HIGHAn open redirect to malicious sites affects HCL LeapEPSS 0.3%CVE-2026-28415MEDIUMGradio has Open Redirect in OAuth FlowEPSS 0.3%CVE-2025-44109MEDIUMA URL redirection in Pinokio v3.6.23 allows attackers to redirect victim users to attacker-controlled pages.EPSS 0.3%CVE-2026-18266MEDIUMDify AI Workflow oauth_redirect_url Open Redirect VulnerabilityEPSS 0.3%CVE-2025-8129MEDIUMKoaJS Koa HTTP Header response.js back redirectEPSS 0.3%CVE-2025-54196MEDIUMAdobe Connect | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)EPSS 0.3%CVE-2026-87937MEDIUMCentral Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135EPSS 0.3%CVE-2026-40465MEDIUMAn Open Re-direct Vulnerability in Nokia NSPEPSS 0.3%CVE-2026-58520MEDIUMUrlShortener defaults to ineffective validation open to third-party redirectsEPSS 0.3%CVE-2026-41670HIGHAdmidio: SAML Response Sent to Unvalidated Assertion Consumer Service URL from AuthnRequestEPSS 0.3%CVE-2025-58006MEDIUMWordPress WP Gravity Forms Keap/Infusionsoft plugin <= 1.2.6 - Open Redirection vulnerabilityEPSS 0.3%CVE-2026-44372MEDIUMNitro: Open Redirect via Protocol-Relative URL Bypass in Wildcard Route RulesEPSS 0.3%CVE-2025-54681MEDIUMWordPress Connector for Gravity Forms and Google Sheets Plugin plugin <= 1.2.4 - Open Redirection VulnerabilityEPSS 0.3%CVE-2025-3522MEDIUMLeak of hashed Window credentials via crafted attachment URLEPSS 0.3%CVE-2024-22308LOWWordPress Simple Membership Plugin <= 4.4.1 is vulnerable to Open RedirectionEPSS 0.3%CVE-2026-55660HIGHTinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeoverEPSS 0.3%CVE-2025-70032MEDIUMAn issue pertaining to CWE-601: URL Redirection to Untrusted Site was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4.EPSS 0.3%CVE-2024-6377HIGHURL redirection to untrusted site (open redirect) vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024xEPSS 0.3%CVE-2025-65581MEDIUMAn open redirect vulnerability exists in the Account module in Volosoft ABP Framework >= 5.1.0 and < 10.0.0-rc.2. Improper validation of theEPSS 0.3%