CWE-601: URL Redirection to Untrusted Site
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Also known as Open Redirect, Cross-site Redirect, Cross-domain Redirect.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- grafanaAn open redirect vulnerability has been identified in Grafana OSS organization switching...4.2 Medium
- grafanaGrafana is vulnerable to XSS attacks through open redirects and path traversal7.6 High
- jeesitethinkgem JeeSite Site Controller SiteController.java select redirect5.3 Medium
- diracgrid diracx-webDiracX-Web login page has Open Redirect vulnerability4.7 Medium
- oracle application expressVulnerability in Oracle Application Express (component: Strategic Planner Starter App). ...9.0 Critical
- labredescefetrj wegiaWeGIA vulnerable to Open Redirect in endpoint 'control.php' parameter 'nextPage'4.7 Medium
- sap se businessobjects content administrator workbenchOpen Redirect vulnerability in SAP BusinessObjects Content Administrator workbench6.1 Medium
- sap se netweaver application server abapMultiple vulnerabilities in SAP NetWeaver Application Server ABAP6.1 Medium
- better-authBetter Auth has an Open Redirect Vulnerability in originCheck Middleware Affecting Multiple Routes2.1 Low
- sir gnuboardAn open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive...6.1 Medium
- sir gnuboardAn open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive...6.1 Medium
- sir gnuboardAn open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive...6.1 Medium
- jordy meow ai engineAI Engine 2.8.4 - Insecure OAuth Implementation8.0 High
- n8nn8n Login Flow has Open Redirect Vulnerability4.6 Medium
- xuxueli xxl-ssoXuxueli xxl-sso doLogin redirect5.1 Medium
- elastic kibanaKibana Open Redirect4.3 Medium
- mozilla firefoxFirefox for Android opened URLs specified in a link querystring parameter4.3 Medium
- java-aodeng hope-bootjava-aodeng Hope-Boot Login WebController.java doLogin redirect5.3 Medium
- ibm process miningIBM Process Mining HTTP open redirect6.8 Medium
- fastgptFastGPT LastRoute Parameter on Login Page Vulnerable to Open Redirect and DOM-based XSS5.5 Medium
- go-chi chigo-chi chi before v5.2.2 Open Redirect via RedirectSlashes5.1 Medium
- phpgurukul covid19 testing management systemPHPGurukul COVID19 Testing Management System search-report-result.php redirect5.1 Medium
- python urllib3urllib3 does not control redirects in browsers and Node.js5.3 Medium
- python urllib3urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation5.3 Medium
- aman funnelkit automationsWordPress Automation By Autonami plugin <= 3.6.0 - Open Redirection Vulnerability4.7 Medium
- m-files mobileOpen redirection in M-Files Mobile4.8 Medium
- astun technology ishare mapsAstun Technology iShare Maps atCheckJS.aspx redirect5.3 Medium
- solarwinds observability self-hostedSolarWinds SWOSH Open Redirection Vulnerability4.8 Medium
- crm perks wp gravity forms constant contact pluginWordPress WP Gravity Forms Constant Contact Plugin <= 1.1.0 - Open Redirection Vulnerability4.7 Medium
- crm perks wp gravity forms salesforceWordPress WP Gravity Forms Salesforce plugin <= 1.4.7 - Open Redirection Vulnerability4.7 Medium
- automattic newspack newslettersWordPress Newspack Newsletters plugin <= 3.13.0 - Open Redirection Vulnerability4.7 Medium
- wso2 api manager, identity server, identity server as key manager +3 more +5 moreOpen Redirection in Multiple WSO2 Products via Multi-Option Authentication Endpoint5.4 Medium
- mauticOpen Redirect vulnerability on user unlock path5.4 Medium
- zitadelZITADEL Allows Account Takeover via Malicious X-Forwarded-Proto Header Injection8.1 High
- summer pearl group vacation rental management platformSummer Pearl Group Vacation Rental Management Platform Header redirect5.1 Medium
- ubtech freepassUBtech – CWE-601: URL Redirection to Untrusted Site ('Open Redirect')6.1 Medium
- wecantrack affiliate sales in google analytics and other toolsAffiliate Sales in Google Analytics and other tools <= 2.0.0 - Open Redirect6.1 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2025.03.2 open redirect was possible on editing VCS Root page4.3 Medium
- grafanaGrafana Cross-Site-Scripting (XSS) via custom loaded frontend plugin7.6 High
- kanwangzjm funiturekanwangzjm Funiture Login LoginServlet.java doPost redirect5.3 Medium
- dpgaspar flask-appbuilderFlask-AppBuilder open redirect vulnerability using HTTP host injection4.3 Medium
- icewarp mail serverOpen redirection vulnerability in IceWarp Mail Server5.1 Medium
- hkdigit payment gateway for telcellPayment Gateway for Telcell <= 2.0.1 - Unauthenticated Open Redirect6.1 Medium
- unknown wccp-pro, wp-buy wp content copy protection \& no right click +1 moreWP Content Copy Protection & No Right Click (premium) < 15.3 - Open Redirect6.1 Medium
- horillaHorilla Open Redirect Vulnerability in Login6.1 Medium
- sap supplier relationship management, sap se supplier relationship management (live auction cockpit) +1 moreMultiple vulnerabilities in SAP Supplier Relationship Management (Live Auction Cockpit)6.1 Medium
- catalyst user key authentication pluginCatalyst User Key Authentication Plugin Logout logout.php redirect5.3 Medium
- haloitsm itsmHaloITSM open redirect via the returnUrl7.1 High
- insagenda insa-authinsa-auth Open-Redirect on provided CAS server login endpoint1.3 Low
- formsintegrations integrations of zoho crm with elementor formWordPress Integrations of Zoho CRM with Elementor form plugin <= 1.0.8 - Open Redirection Vulnerability4.7 Medium
- Show moreLoading…