CWE-601: URL Redirection to Untrusted Site
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Also known as Open Redirect, Cross-site Redirect, Cross-domain Redirect.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- lobehub lobe-chat, lobe chat +1 morelobe-chat has an Open Redirect4.3 Medium
- crm perks wp gravity forms keap/infusionsoftWordPress WP Gravity Forms Keap/Infusionsoft plugin <= 1.2.6 - Open Redirection vulnerability4.7 Medium
- pusula communication information internet industry and trade ltd. co. manageable email sending systemOpen Redirect in PUSULA's Manageable Email Sending System4.7 Medium
- mattermost, mattermost server +1 moreOne-Click Mattermost Account Takeover via Poisoned RelayState SAML Parameter7.6 High
- mattermost, mattermost server +1 moreOpen redirect in OAuth login3.1 Low
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal's System, Instance and Site Settings are vulnerable to Open Redirect5.1 Medium
- No product listedFreshwork logout redirect5.3 Medium
- goodbarberWordPress GoodBarber plugin <= 1.0.26 - Open Redirection Vulnerability4.7 Medium
- typo3, typo3 cms +1 moreOpen Redirect in TYPO3 CMS5.3 Medium
- element-plusElement Plus Link component (el-link) implements insufficient input validation for the href attribute6.4 Medium
- cisco webex meetingsA vulnerability in Cisco Webex Meetings could have allowed an unauthenticated, remote attacker to...4.3 Medium
- akinsoft qr menu, akınsoft qr menü +1 moreOpen Redirect in Akinsoft's QR Menu6.3 Medium
- basecamp google sign inBasecamp's Google Sign-In for Rails allowed redirects to protocol-relative URI4.2 Medium
- eric teubert podlove podcast publisherWordPress Podlove Podcast Publisher Plugin <= 4.2.5 - Open Redirection Vulnerability4.7 Medium
- basecamp google sign inBasecamp's Google Sign-In for Rails allowed redirects to a malformed URL4.2 Medium
- cisco unified computing system (managed), unified computing system (standalone), unified computing system e-series software (ucse) +2 moreCisco UCS Virtual Keyboard Video Monitor (vKVM) Open Redirect Vulnerability7.1 High
- ibm cognos command centerIBM Cognos Command Center HTTP Open Redirect7.4 High
- selectzeroSelectZero SelectZero Data Observability Platform before 2025.5.2 contains an Open Redirect...6.5 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal allows open redirect in /c/portal/edit_info_item parameter redirect5.1 Medium
- advplyr audiobookshelfAudiobookshelf vulnerable to OIDC token exfiltration and account takeover8.8 High
- reolinkAn open redirect vulnerability in Reolink v4.54.0.4.20250526 allows attackers to redirect users...6.3 Medium
- reolinkAn intent redirection vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers...5.3 Medium
- hackucf onboardliteOnboardLite Open Redirect Endpoint5.1 Medium
- red hat mirror registry for red hat openshiftMirror-registry: host header injection in mirror-registry6.5 Medium
- six apart ltd. movable type (cloud edition), movable type (software edition), movable type advanced (software edition) +3 more +5 moreURL redirection to untrusted site ('Open Redirect') issue exists in Movable Type. If this...5.1 Medium
- totvs portal meu rhTOTVS Portal Meu RH Password Reset redirect5.1 Medium
- mozilla focus for ios, firefox focus +1 moreFocus incorrectly ignores Content-Disposition headers for some MIME types6.1 Medium
- mozilla firefox, firefox for ios, focus for ios +1 more +3 morePasskey phishing within Bluetooth range9.8 Critical
- bunkerity bunker webBunker Web 1.6.2 - Uncontrolled external site redirect4.8 Medium
- withastro astro@astrojs/node's trailing slash handling causes open redirect issue5.5 Medium
- crm perks connector for gravity forms and google sheetsWordPress Connector for Gravity Forms and Google Sheets Plugin plugin <= 1.2.4 - Open Redirection Vulnerability4.7 Medium
- darylldoyle svg-sanitizersvg-sanitizer By-Passing Attribute Sanitization5.1 Medium
- atjiu pybbsatjiu pybbs IndexController.java changeLanguage redirect5.1 Medium
- zlt2000 microservices-platformzlt2000 microservices-platform OauthLogoutSuccessHandler.java onLogoutSuccess redirect5.1 Medium
- astroAstro: Duplicate trailing slash feature can lead to Open Redirects5.5 Medium
- ibm operational decision managerIBM Operational Decision Manager HTTP open redirect7.4 High
- No product listedAn open redirect in Sielox AnyWare v2.1.2 allows attackers to execute a man-in-the-middle attack...6.3 Medium
- glpi-project glpiGLPI is vulnerable to XSS and open redirection attacks through planning feature6.5 Medium
- linuxserver docker-heimdallLinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP...9.8 Critical
- axiomthemes anubisAnubis accepts crafted redirect URLs in pass-challenge 'Try Again' buttons5.1 Medium
- koajs koaKoaJS Koa HTTP Header response.js back redirect5.1 Medium
- hotelrunner b2bOpen Redirect in HotelRunner's B2B4.7 Medium
- mozilla firefox, firefox for ios +1 moreScanning a malicious URL utilizing Firefox's open-text scheme with the QR code scanner could load arbitrary websites9.1 Critical
- mozilla firefox, firefox for ios +1 moreInternal Firefox open-text URL scheme allowed loading of arbitrary URLs5.4 Medium
- No product listedA URL redirection in lbry-desktop v0.53.9 allows attackers to redirect victim users to attacker...5.4 Medium
- No product listedA URL redirection in Pinokio v3.6.23 allows attackers to redirect victim users to attacker...5.4 Medium
- publiccmsSanluan PublicCMS viewer.html redirect5.1 Medium
- publiccmsSanluan PublicCMS preview.html redirect5.1 Medium
- jeesitethinkgem JeeSite ServletUtils.java redirectUrl5.1 Medium
- jeesitethinkgem JeeSite SsoController.java sso redirect5.3 Medium
- Show moreLoading…