Fallos del tipo CWE-601

1191 resultados

Redirecionamento para URL não validada (Open Redirect)

A aplicação redireciona o usuário para uma URL fornecida por ele (parâmetro GET/POST, referer, etc.) sem validar se o destino é confiável. Um atacante pode usar isso para levar vítimas a sites maliciosos, phishing ou roubo de credenciais, enquanto a URL legítima da sua app aparece no clique inicial.

Ejemplo

Um site de e-commerce redireciona após login com `redirect.php?url=google.com`. Um atacante envia `redirect.php?url=seusite-fake.com` disfarçado de e-mail de confirmação. A vítima clica, vê a URL legítima na barra de endereço até o redirecionamento, e cai em um fake convincente.

Cómo mitigar

Valide a URL de destino contra uma whitelist de domínios permitidos ou, no mínimo, verifique se o host da URL é o seu próprio domínio antes de redirecionar. Nunca redirecione para URLs externas fornecidas pelo usuário sem controle explícito.

CVE-2025-42924MEDIUMOpen Redirect vulnerabilities in SAP S/4HANA landscape (SAP E-Recruiting BSP)EPSS 0.2%CVE-2025-58204MEDIUMWordPress Podlove Podcast Publisher Plugin <= 4.2.5 - Open Redirection VulnerabilityEPSS 0.2%CVE-2026-23727MEDIUMWeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=TipoSaidaControle)EPSS 0.2%CVE-2026-25392MEDIUMWordPress Update URLs – Quick and Easy way to search old links and replace them with new links in WordPress plugin <= 1.4.0 - Open Redirection vulnerabilityEPSS 0.2%CVE-2026-21741LOWAn URL Redirection to Untrusted Site ('Open Redirect') vulnerability [CWE-601] vulnerability in Fortinet FortiNAC-F 7.6.0 through 7.6.5, ForEPSS 0.2%CVE-2025-62981MEDIUMWordPress WP Gravity Forms Zoho CRM and Bigin plugin <= 1.2.8 - Open Redirection vulnerabilityEPSS 0.2%CVE-2026-47051MEDIUMVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Supported versions that are affeEPSS 0.2%CVE-2026-47048MEDIUMVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Supported versions that are affeEPSS 0.2%CVE-2026-25651MEDIUMclient-certificate-auth has an Open Redirect via Host Header Injection in HTTP-to-HTTPS redirectEPSS 0.2%CVE-2026-12379MEDIUMURL Redirection to Untrusted Site ('Open Redirect') vulnerability in the Dashboard OAuth/OIDC implementation of AxivionEPSS 0.2%CVE-2026-12622MEDIUMOpen Redirect Vulnerability in Password Reset Submission in GridTime™ 3000 GNSS Time ServerEPSS 0.2%CVE-2026-14219MEDIUMURL Redirection in Bilin Software's HUMANIST Digital Human ResourcesEPSS 0.2%CVE-2026-83198MEDIUMVulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are EPSS 0.2%CVE-2025-70037MEDIUMAn issue pertaining to CWE-601: URL Redirection to Untrusted Site was discovered in linagora Twake v2023.Q1.1223. This allows attackers to oEPSS 0.2%CVE-2025-66062LOWWordPress WP YouTube Lyte plugin <= 1.7.28 - Open Redirection vulnerabilityEPSS 0.2%CVE-2025-67587MEDIUMWordPress WP Gravity Forms FreshDesk Plugin plugin <= 1.3.5 - Open Redirection vulnerabilityEPSS 0.2%CVE-2026-20178MEDIUMA vulnerability in the browser-based version of Cisco Webex App could have allowed an unauthenticated, remote attacker to redirect users to EPSS 0.2%CVE-2026-20060MEDIUMCisco Unity Connection Open Redirect VulnerabilityEPSS 0.2%CVE-2025-4296MEDIUMOpen Redirect in HotelRunner's B2BEPSS 0.2%CVE-2026-0513MEDIUMOpen Redirect Vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog)EPSS 0.2%