CWE-601: URL Redirection to Untrusted Site
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Also known as Open Redirect, Cross-site Redirect, Cross-domain Redirect.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- crm perks wp gravity forms zendeskWordPress WP Gravity Forms Zendesk plugin <= 1.1.2 - Open Redirection Vulnerability4.7 Medium
- crm perks integration for woocommerce and salesforceWordPress Integration for WooCommerce and Salesforce plugin <= 1.7.5 - Open Redirection Vulnerability4.7 Medium
- crm perks wp gravity forms dynamics crmWordPress WP Gravity Forms Dynamics CRM plugin <= 1.1.4 - Open Redirection Vulnerability4.7 Medium
- fp2952 spring-cloud-basefp2952 spring-cloud-base HTTP Header MvcController.java sendBack redirect5.1 Medium
- misskey summaly@misskey-dev/summaly Redirect Filter Bypass2.1 Low
- cloudflare workers-oauth-providerMissing validation of redirect_uri on authorize endpoint6.0 Medium
- mozilla firefox focus, focus +1 moreFirefox Focus elide URL allows address bar spoofing6.1 Medium
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability6.1 Medium
- filez clientAn open redirect vulnerability was reported in the FileZ client that could allow information...5.1 Medium
- heateor support sassy social shareWordPress Sassy Social Share plugin <= 3.3.73 - Open Redirection vulnerability4.7 Medium
- knowbe4 security awareness trainingThe KnowBe4 Security Awareness Training application before 2020-01-10 contains a redirect...5.3 Medium
- arthur yarwood fast ebay listingsWordPress Fast eBay Listings plugin <= 2.12.15 - Open Redirection Vulnerability4.7 Medium
- webilia inc. listdomWordPress Listdom plugin <= 4.0.0 - Open Redirection Vulnerability4.7 Medium
- mozilla thunderbirdLeak of hashed Window credentials via crafted attachment URL6.3 Medium
- significant-gravitas autogpt, agpt autogpt platform +1 moreAutoGPT allows leakage of cross-domain cookies and protected headers in requests redirect8.6 High
- softcom iksorisXSS in iKSORIS5.1 Medium
- webinarpressWordPress WebinarPress plugin <= 1.33.28 - Open Redirection Vulnerability4.7 Medium
- rustaurius ultimate wp mailWordPress Ultimate WP Mail plugin <= 1.3.10 - Open Redirection vulnerability4.7 Medium
- smartdevth advanced advertising systemAdvanced Advertising System <= 1.3.1 - Open Redirect6.1 Medium
- gnome yelp, debian linux, red hat enterprise linux 6 +33 more +35 moreYelp: arbitrary file read7.4 High
- galaxy weblinks wp clone any post typeWordPress WP Clone any post type Plugin <= 3.6 - Open Redirect vulnerability4.7 Medium
- formsintegrations integration of zoho crm and contact form 7WordPress Integration of Zoho CRM and Contact Form 7 plugin <= 1.0.6 - Open Redirection Vulnerability4.7 Medium
- apple ipados, macos, safari +4 more +6 moreThe issue was addressed with improved input validation. This issue is fixed in Safari 18.4,...8.1 High
- primekey ejbcaOpen Redirect vulnerability in EJBCA5.1 Medium
- legrand sms powerviewLegrand SMS PowerView redirect5.1 Medium
- dell unity, unity operating environment +1 moreDell Unity, version(s) 5.4 and prior, contain(s) an URL Redirection to Untrusted Site ('Open...8.8 High
- bit apps form, unknown bit form +1 moreWordPress Bit Form plugin <= 2.18.0 - Open Redirection vulnerability4.7 Medium
- bit apps integrationsWordPress Bit Integrations plugin <= 2.4.10 - Open Redirection vulnerability4.7 Medium
- ali2woo alinextWordPress AliNext plugin <= 3.5.1 - Open Redirection vulnerability4.7 Medium
- aman funnelkit automationsWordPress Automation By Autonami plugin <= 3.5.1 - Open Redirection vulnerability4.7 Medium
- wpfactory scheduled & automatic order status controller for woocommerceWordPress Scheduled & Automatic Order Status Controller for WooCommerce plugin <= 3.7.1 - Open Redirection Vulnerability4.7 Medium
- icinga web 2, icingaweb2 +1 moreIcinga Web 2 has open redirect on login page4.1 Medium
- apache druidApache Druid: Server-Side Request Forgery and Cross-Site Scripting5.8 Medium
- gradio-app gradio-app/gradio, gradio project gradio +1 moreOpen Redirect in gradio-app/gradio5.4 Medium
- haotian-liu haotian-liu/llava, hliu llava +1 moreOpen Redirect in haotian-liu/llava6.1 Medium
- lm-sys fastchat, lm-sys/fastchat +1 moreOpen Redirect in lm-sys/fastchat6.1 Medium
- automatic1111 automatic1111/stable-diffusion-webui, stable-diffusion-webui +1 moreOpen Redirect in automatic1111/stable-diffusion-webui6.1 Medium
- binary-husky binary-husky/gpt academic, gpt academic +1 moreOpen Redirect in binary-husky/gpt_academic6.1 Medium
- dell networkerDell NetWorker, 19.11.0.3 and below versions, contain(s) an Open Redirect Vulnerability in NMC....4.3 Medium
- akshar soft solutions as english adminWordPress AS English Admin plugin <= 1.0.0 - Open Redirection vulnerability4.7 Medium
- zucchetti ad hoc infinityIn Zucchetti Ad Hoc Infinity 2.4, an improper check on the m_cURL parameter allows an attacker to...7.6 High
- jenkinsJenkins Open Redirect vulnerability4.3 Medium
- mozilla firefox, firefox for ios +1 moreFirefox Mobile iOS Address Bar Spoof Using Server-Side Redirect to non-http Scheme4.3 Medium
- mozilla firefox, firefox for ios +1 moreFirefox Mobile iOS Full Address Bar Spoof Using Server-Side Redirect to internal error page5.4 Medium
- ericsson codecheckerOpen redirect in CodeChecker web server6.1 Medium
- nagios xiNagios XI 2024R1.2.2 is vulnerable to an open redirect flaw on the Tools page, exploitable by...6.1 Medium
- glpi-project glpiGLPI index.php redirect5.3 Medium
- better-authbetter-auth before 1.1.20 Open Redirect via trustedOrigins Bypass7.1 High
- better-auth better auth, better-auth +1 moreBeter Auth has an Open Redirect via Scheme-Less Callback Parameter6.9 Medium
- wpo365 microsoft 365 graph mailer, | microsoft 365 graph mailer +1 moreWPO365 | MICROSOFT 365 GRAPH MAILER <= 3.2 - Open Redirect via 'redirect_to' Parameter4.7 Medium
- Show moreLoading…