Weaknesses of type CWE-601

1,188 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2026-53728HIGHMedplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code LeakageEPSS 0.2%CVE-2025-67585MEDIUMWordPress Flexmls® IDX plugin <= 3.15.7 - Open Redirection vulnerabilityEPSS 0.2%CVE-2026-45055HIGHCubeCart: Pre-Authenticated Password Reset Link Poisoning via HTTP Host HeaderEPSS 0.2%CVE-2025-34440MEDIUMAVideo < 20.1 Open Redirect via siteRedirectUri ParameterEPSS 0.2%CVE-2025-34439MEDIUMAVideo < 20.1 Open Redirect via cancelUri ParameterEPSS 0.2%CVE-2025-12789MEDIUMRhsso: open redirectEPSS 0.2%CVE-2025-55254LOWHCL BigFix Remote Control is vulnerable to a Path-relative stylesheet import (PRSSI)EPSS 0.2%CVE-2026-60650HIGHVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions tEPSS 0.2%CVE-2026-60646HIGHVulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions tEPSS 0.2%CVE-2026-20123MEDIUMCisco Prime Infrastructure and Evolved Programmable Network Manager Open Redirect VulnerabilityEPSS 0.2%CVE-2025-26394MEDIUMSolarWinds SWOSH Open Redirection VulnerabilityEPSS 0.2%CVE-2026-61082MEDIUMVulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 9.7.0-9.7.EPSS 0.2%CVE-2025-60935MEDIUMAn open redirect vulnerability in the login endpoint of Blitz Panel v1.17.0 allows attackers to redirect users to malicious domains via a crEPSS 0.2%CVE-2026-61097CRITICALVulnerability in the Oracle Banking Trade Finance Process Management product of Oracle Financial Services Applications (component: Common). EPSS 0.2%CVE-2025-71244MEDIUMSPIP < 4.4.5 Open Redirect via Login FormEPSS 0.2%CVE-2024-12924MEDIUMOpen Redirect in Akinsoft's QR MenuEPSS 0.2%CVE-2025-43767MEDIUMOpen Redirect vulnerability in /c/portal/edit_info_item parameter redirect in Liferay Portal 7.4.3.86 through 7.4.3.131, and Liferay DXP 202EPSS 0.2%CVE-2025-54088MEDIUMOpen Redirect in Secure Access prior to 14.10EPSS 0.2%CVE-2025-59013MEDIUMOpen Redirect in TYPO3 CMSEPSS 0.2%CVE-2026-25649HIGHTraccar Vulnerable to Authorization Code Theft via Open Redirect in OIDC Provider EndpointsEPSS 0.2%