CWE-601: URL Redirection to Untrusted Site
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Also known as Open Redirect, Cross-site Redirect, Cross-domain Redirect.
A kind of CWE-610 Externally Controlled Reference to a Resource in Another Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- zauberzeug niceguiNiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write7.5 High
- web2pyweb2py has an Open Redirect Vulnerability5.1 Medium
- cisco evolved programmable network manager (epnm), prime infrastructure, evolved programmable network manager +2 moreCisco Prime Infrastructure and Evolved Programmable Network Manager Open Redirect Vulnerability4.3 Medium
- qwikQwik City Open Redirect via fixTrailingSlash2.7 Low
- anthropic claude code, anthropics claude-code +1 moreClaude Code has a Domain Validation Bypass which Allows Automatic Requests to Attacker-Controlled Domains7.1 High
- moodleMoodle: moodle: open redirect vulnerability in oauth login flow allows redirection to malicious sites.3.5 Low
github.com/h44z/wg-portalGoWireGuard Portal v2 has Open Redirect Vulnerability in OAuth Authentication Flow6.1 Medium- nocodbNocoDB has Unvalidated Redirect in Login Flow via continueAfterSignIn Parameter5.7 Medium
- vercel next.jsNext.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname8.3 High
- lcg0124 bootdolcg0124 BootDo Host Header AccessControlFilter.java redirectToLogin5.1 Medium
- kozea weasyprint, red hat ansible automation platform 2 +1 moreWeasyPrint Vulnerable to Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect7.5 High
- labredescefetrj wegiaWeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=ProdutoControle)4.8 Medium
- labredescefetrj wegiaWeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarDescricao, nomeClasse=ProdutoControle)4.8 Medium
- labredescefetrj wegiaWeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=DestinoControle)4.8 Medium
- labredescefetrj wegiaWeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=TipoSaidaControle)4.8 Medium
- labredescefetrj wegiaWeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=TipoEntradaControle)4.8 Medium
- sick tdc-x401gl firmware, sick ag tdc-x401gl +1 moreImproper validation of a login parameter may allow attackers to redirect users to malicious...4.3 Medium
- go-chi chigo-chi chi 5.2.2 through 5.5.0 Open Redirect via RedirectSlashes Middleware5.1 Medium
github.com/go-chi/chiGo,github.com/go-chi/chi/v2Go,github.com/go-chi/chi/v3Go +6 more +8 moreDuplicate Advisory: chi has an open redirect vulnerability in the RedirectSlashes middleware4.7 Medium- sap supplier relationship management, sap se supplier relationship management (sicf handler in srm catalog) +1 moreOpen Redirect Vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog)4.7 Medium
- @tanstack react-routerReact Router has unexpected external redirect via untrusted paths6.5 Medium
- kanboardKanboard vulnerable to Open Redirect via protocol-relative URLs4.7 Medium
- guangzhou v v-sol gpon/epon olt platformV-SOL GPON/EPON OLT Platform V2.03.62R_IPv6 v2.03 Open Redirect via bindProfile.html5.1 Medium
- citeum openctiOpen Redirect in OpenCTI's SAML Authentication Flow5.4 Medium
- directusDirectus has open redirect in SAML4.3 Medium
- plexus anblick digital signage managementPlexus anblick Digital Signage Management 3.1.13 Open Redirect via Pagina Parameter5.1 Medium
- curlbearer token leak on cross-protocol redirect5.3 Medium
- ksenia security s.p.a. lares, kseniasecurity lares firmware +1 moreKsenia Security lares Home Automation 1.6 URL Redirection Vulnerability5.1 Medium
- edimax br-6208ac, br-6208ac firmware +1 moreEdimax BR-6208AC Web-based Configuration formALGSetup redirect5.1 Medium
- cloudpanel community editionCloudPanel Community Edition HTTP Header users redirect5.1 Medium
- com.ritense.valtimo webPriority - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')6.1 Medium
- scott paterson accept donations with paypal & stripeWordPress Accept Donations with PayPal plugin <= 1.5.2 - Open Redirection vulnerability4.7 Medium
- jeff starr user submitted postsWordPress User Submitted Posts plugin <= 20251121 - Open Redirection vulnerability4.7 Medium
- returnfi blitzAn open redirect vulnerability in the login endpoint of Blitz Panel v1.17.0 allows attackers to...6.1 Medium
- restajet online food delivery systemOpen Redirect in Restajet's Online Food Delivery System5.4 Medium
- apple macos, safari +1 moreThis issue was addressed with improved URL validation. This issue is fixed in macOS Tahoe 26.2,...9.8 Critical
- hcl software bigfix remote control, hcltechsw hcl devops deploy, hcl launch +2 moreHCL BigFix Remote Control is vulnerable to a Path-relative stylesheet import (PRSSI)3.7 Low
- world wide broadcast network avideoAVideo < 20.1 Open Redirect via cancelUri Parameter4.8 Medium
- world wide broadcast network avideoAVideo < 20.1 Open Redirect via siteRedirectUri Parameter4.8 Medium
- mattermost, mattermost server +1 moreOpen redirect in error page when link opened in new tab3.1 Low
- unknown wbce cms, wbce cms +1 moreWBCE CMS 1.6.1 Cross-Site Scripting and Open Redirect Vulnerability7.1 High
- wpwax directoristWordPress Directorist plugin <= 8.6.6 - Open Redirection vulnerability4.7 Medium
- volosoft abpABP Account Module has an Open Redirect through Improper validation in its register function5.3 Medium
- mayan edms, mayan-edms mayan edms +1 moreMayan EDMS authentication redirect5.3 Medium
- solutionsbysteve solutions ad managerSolutions Ad Manager <= 1.0.0 - Unauthenticated Open Redirect via 'sam-redirect-to' Parameter4.7 Medium
- collabora kodexplorerKodExplorer 4.52 Open Redirect Vulnerability via User Login Endpoint5.3 Medium
- miniflux project miniflux, miniflux v2 +1 moreMiniflux 2 has an Open Redirect via protocol-relative `redirect_url`5.3 Medium
- remram44 taguetteTaguette does not safeguard against Open Redirect5.4 Medium
- crm perks wp gravity forms freshdesk pluginWordPress WP Gravity Forms FreshDesk Plugin plugin <= 1.3.5 - Open Redirection vulnerability4.7 Medium
- flexmls flexmls® idxWordPress Flexmls® IDX plugin <= 3.15.7 - Open Redirection vulnerability4.7 Medium
- Show moreLoading…