Weaknesses of type CWE-601

1,296 results

Redirecionamento aberto para site não confiável

É quando uma aplicação redireciona o usuário para uma URL fornecida por ele (ou por um atacante) sem validação prévia. O navegador segue o redirecionamento automaticamente, levando a vítima para um site malicioso que pode clonar a interface legítima para roubar credenciais ou distribuir malware, com aparência de vir de um domínio confiável.

Example

Um link do tipo `https://banco.com/redirect?url=https://banco-falso.com` recebe a URL de destino como parâmetro e redireciona direto sem checagem. Atacante envia `https://banco.com/redirect?url=https://phishing.com` em email, e a vítima clica pensando estar acessando o banco.

How to mitigate

Valide sempre a URL de destino contra uma lista branca de domínios permitidos ou use URLs relativas. Se aceitar redirecionamentos dinâmicos, verifique que o host pertence ao seu domínio ou a uma lista explícita de parceiros confiáveis.

CVE-2026-91428MEDIUMVulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-2EPSS 0.2%CVE-2025-58204MEDIUMWordPress Podlove Podcast Publisher Plugin <= 4.2.5 - Open Redirection VulnerabilityEPSS 0.2%CVE-2026-39484MEDIUMWordPress Hide My WP Ghost plugin < 7.0.00 - Open Redirection vulnerabilityEPSS 0.2%CVE-2026-21741LOWAn URL Redirection to Untrusted Site ('Open Redirect') vulnerability [CWE-601] vulnerability in Fortinet FortiNAC-F 7.6.0 through 7.6.5, ForEPSS 0.2%CVE-2026-48924MEDIUMJenkins Bitbucket OAuth Plugin 0.17 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacEPSS 0.2%CVE-2026-47051MEDIUMVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Supported versions that are affeEPSS 0.2%CVE-2025-12789MEDIUMRhsso: open redirectEPSS 0.2%CVE-2025-55706MEDIUMURL redirection to untrusted site ('Open Redirect') issue exists in Movable Type. If this vulnerability is exploited, an invalid parameter EPSS 0.2%CVE-2026-47048MEDIUMVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Supported versions that are affeEPSS 0.2%CVE-2026-12379MEDIUMURL Redirection to Untrusted Site ('Open Redirect') vulnerability in the Dashboard OAuth/OIDC implementation of AxivionEPSS 0.2%CVE-2026-83198MEDIUMVulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are EPSS 0.2%CVE-2026-14219MEDIUMURL Redirection in Bilin Software's HUMANIST Digital Human ResourcesEPSS 0.2%CVE-2026-12622MEDIUMOpen Redirect Vulnerability in Password Reset Submission in GridTime™ 3000 GNSS Time ServerEPSS 0.2%CVE-2026-39985MEDIUMLORIS has an open redirect field on loginEPSS 0.2%CVE-2026-40096MEDIUMimmich: Open Redirect via Shared Album nameEPSS 0.2%CVE-2026-31819MEDIUMSylius has an Open Redirect via Referer HeaderEPSS 0.2%CVE-2026-0513MEDIUMOpen Redirect Vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog)EPSS 0.2%CVE-2026-44437MEDIUMAngular SSR: Open Redirect and Request Steering via Encoded X-Forwarded-PrefixEPSS 0.2%CVE-2024-12141MEDIUMOpen Redirect via Callback URL Validation in WSO2 Products Allows Phishing AttacksEPSS 0.2%CVE-2026-116376LOWMultiple vulnerabilities that affects IBM Db2 Genius HubEPSS 0.2%