Weaknesses of type CWE-601

1,296 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2026-103523MEDIUMCVE-2026-103523EPSS 0.3%CVE-2025-64115MEDIUMMovary unvalidated Referer header allows open redirect and phishingEPSS 0.3%CVE-2025-62379LOWOpen Redirect in reflex-dev/reflexEPSS 0.3%CVE-2025-11240MEDIUMOpen redirect vulnerability in KNIME Business HubEPSS 0.3%CVE-2025-13819MEDIUMOpen redirect in web server of MiR robots and MiR fleetEPSS 0.3%CVE-2023-50345LOWOpen Redirect affects DRYiCE MyXalyticsEPSS 0.3%CVE-2025-47890LOWAn URL Redirection to Untrusted Site vulnerabilities [CWE-601] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through EPSS 0.3%CVE-2024-27184MEDIUM[20240801] - Core - Inadequate validation of internal URLsEPSS 0.3%CVE-2026-84662MEDIUMJenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding, allowing attackersEPSS 0.3%CVE-2026-101403MEDIUMVulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing). Supported versions that are affecteEPSS 0.3%CVE-2026-56330MEDIUMCapgo - Open Redirect via Unvalidated Stripe Billing URLsEPSS 0.3%CVE-2025-20378LOWOpen Redirect on Web Login endpoint in Splunk EnterpriseEPSS 0.3%CVE-2025-52897MEDIUMGLPI is vulnerable to XSS and open redirection attacks through planning featureEPSS 0.3%CVE-2024-30140MEDIUMHCL BigFix Compliance is affected by unvalidated redirects and forwardsEPSS 0.3%CVE-2025-64116MEDIUMMovary vulnerable to an open redirectEPSS 0.3%CVE-2026-96773MEDIUMIntelliants Subrion CMS Login Page login.php authorize redirectEPSS 0.3%CVE-2026-109160MEDIUMPublicCMS pay Endpoint SafeConfigComponent.java SafeConfigComponent.getSafeUrl redirectEPSS 0.3%CVE-2026-34315MEDIUMVulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). Supported versions that are affeEPSS 0.3%CVE-2025-57821MEDIUMBasecamp's Google Sign-In for Rails allowed redirects to a malformed URLEPSS 0.3%CVE-2026-11502LOWJeecgBoot Third-Party Login ThirdLoginController.java HttpServletResponse.sendRedirect redirectEPSS 0.3%