CWE-601 · URL Redirection to Untrusted Site (Open Redirect) (page 4)
Page 4 of 17 — CVEs classified under CWE-601, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-66596 | Medium | 6.1 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not properly validate request headers. When an att… |
CVE-2026-2153 | Medium | 4.3 | 2026-02-08 | A vulnerability was determined in mwielgoszewski doorman up to 0.6. This issue affects the function is_safe_url of the file doorman/users/views.py. Executing a… |
CVE-2026-25651 | Medium | 6.1 | 2026-02-06 | client-certificate-auth is middleware for Node.js implementing client SSL certificate authentication/authorization. Versions 0.2.1 and 0.3.0 of client-certific… |
CVE-2026-1970 | Low | 3.5 | 2026-02-05 | A flaw has been found in Edimax BR-6258n up to 1.18. This issue affects the function formStaDrvSetup of the file /goform/formStaDrvSetup. This manipulation of… |
CVE-2026-25198 | Medium | 4.7 | 2026-02-05 | web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an open redirect vulnerability. If this vulnerability is exploited, the user may… |
CVE-2026-20123 | Medium | 4.3 | 2026-02-04 | A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an unauth… |
CVE-2026-25149 | Medium | 6.1 | 2026-02-03 | Qwik is a performance focused javascript framework. Prior to version 1.19.0, an Open Redirect vulnerability in Qwik City's default request handler middleware a… |
CVE-2026-24052 | High | 7.4 | 2026-02-03 | Claude Code is an agentic coding tool. Prior to version 1.0.111, Claude Code contained insufficient URL validation in its trusted domain verification mechanism… |
CVE-2025-67852 | Low | 3.5 | 2026-02-03 | A flaw was found in Moodle. An open redirect vulnerability in the OAuth login flow allows a remote attacker to redirect users to attacker-controlled pages afte… |
CVE-2026-24768 | Medium | 6.1 | 2026-01-28 | NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, an unvalidated redirect (open redirect) vulnerability exists in NocoDB’s l… |
CVE-2026-1406 | Low | 3.5 | 2026-01-25 | A vulnerability was determined in lcg0124 BootDo up to 5ccd963c74058036b466e038cff37de4056c1600. Affected by this vulnerability is the function redirectToLogin… |
CVE-2025-68616 | High | 7.5 | 2026-01-19 | WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's `… |
CVE-2026-23730 | Medium | 6.1 | 2026-01-16 | WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint o… |
CVE-2026-23729 | Medium | 6.1 | 2026-01-16 | WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint o… |
CVE-2026-23728 | Medium | 6.1 | 2026-01-16 | WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint o… |
CVE-2026-23727 | Medium | 6.1 | 2026-01-16 | WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint o… |
CVE-2026-23726 | Medium | 6.1 | 2026-01-16 | WeGIA is a web manager for charitable institutions. Prior to 3.6.2, An Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint o… |
CVE-2026-22912 | Medium | 4.3 | 2026-01-15 | Improper validation of a login parameter may allow attackers to redirect users to malicious websites after authentication. This can lead to various risk includ… |
CVE-2026-0513 | Medium | 4.7 | 2026-01-13 | Due to an Open Redirect Vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog), an unauthenticated attacker could craft a maliciou… |
CVE-2025-68470 | Medium | 6.5 | 2026-01-10 | React Router is a router for React. In versions 6.0.0 through 6.30.1 and 7.0.0 through 7.9.5, an attacker-supplied path can be crafted so that when a React Rou… |
CVE-2026-22032 | Medium | 4.3 | 2026-01-08 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.14.0, an open redirect vulnerability exists in the Directu… |
CVE-2025-14524 | Medium | 5.3 | 2026-01-08 | When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3… |
CVE-2026-21879 | Medium | 4.7 | 2026-01-08 | Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below are vulnerable to an Open Redirect attack that allows maliciou… |
CVE-2019-25282 | Critical | 9.8 | 2026-01-08 | V-SOL GPON/EPON OLT Platform v2.03 contains an open redirect vulnerability in the script that allows attackers to manipulate the 'parent' GET parameter. Attack… |
CVE-2025-61782 | Medium | 5.4 | 2026-01-07 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.3, an open redirect vulnerability exi… |
CVE-2020-36912 | Critical | 9.8 | 2026-01-06 | Plexus anblick Digital Signage Management 3.1.13 contains an open redirect vulnerability in the 'PantallaLogin' script that allows attackers to manipulate the… |
CVE-2025-15112 | Medium | 5.4 | 2025-12-30 | Ksenia Security lares (legacy model) version 1.6 contains a URL redirection vulnerability in the 'cmdOk.xml' script that allows attackers to manipulate the 're… |
CVE-2025-15258 | Low | 3.5 | 2025-12-30 | A weakness has been identified in Edimax BR-6208AC 1.02/1.03. Affected by this issue is the function formALGSetup of the file /goform/formALGSetup of the compo… |
CVE-2025-15241 | Low | 3.5 | 2025-12-30 | A security vulnerability has been detected in CloudPanel Community Edition up to 2.5.1. The affected element is an unknown function of the file /admin/users of… |
CVE-2025-55060 | Medium | 6.1 | 2025-12-29 | CWE-601 URL Redirection to Untrusted Site ('Open Redirect') |
CVE-2025-60935 | Medium | 6.1 | 2025-12-24 | An open redirect vulnerability in the login endpoint of Blitz Panel v1.17.0 allows attackers to redirect users to malicious domains via a crafted URL. This iss… |
CVE-2025-68602 | Medium | 4.7 | 2025-12-24 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Scott Paterson Accept Donations with PayPal & Stripe easy-paypal-donation allows Phishing… |
CVE-2025-68509 | Medium | 4.7 | 2025-12-24 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Jeff Starr User Submitted Posts user-submitted-posts allows Phishing.This issue affects Us… |
CVE-2025-1885 | Medium | 5.4 | 2025-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Restajet Information Technologies Inc. Online Food Delivery System allows Phishing, Forcef… |
CVE-2025-55254 | Low | 3.7 | 2025-12-17 | Improper management of Path-relative stylesheet import in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow to execute malic… |
CVE-2025-43526 | Critical | 9.8 | 2025-12-17 | This issue was addressed with improved URL validation. This issue is fixed in Safari 26.2, macOS Tahoe 26.2. On a Mac with Lockdown Mode enabled, web content o… |
CVE-2025-34440 | Medium | 6.1 | 2025-12-17 | AVideo versions prior to 20.1 contain an open redirect vulnerability caused by insufficient validation of the siteRedirectUri parameter during user registratio… |
CVE-2025-34439 | Medium | 6.1 | 2025-12-17 | AVideo versions prior to 20.1 are vulnerable to an open redirect flaw due to missing validation of the cancelUri parameter during user login. An attacker can c… |
CVE-2025-62690 | Low | 3.1 | 2025-12-17 | Mattermost versions 10.11.x <= 10.11.4 fail to validate redirect URLs on the /error page, which allows an attacker to redirect a victim to a malicious site via… |
CVE-2025-65581 | Medium | 5.3 | 2025-12-16 | An open redirect vulnerability exists in the Account module in Volosoft ABP Framework >= 5.1.0 and < 10.0.0-rc.2. Improper validation of the returnUrl paramete… |
CVE-2023-53901 | Medium | 5.4 | 2025-12-16 | WBCE CMS 1.6.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML and CSS to capture user keystrokes. Attackers can u… |
CVE-2025-64250 | Medium | 4.7 | 2025-12-16 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in wpWax Directorist directorist allows Phishing.This issue affects Directorist: from n/a thr… |
CVE-2025-14692 | Medium | 4.3 | 2025-12-15 | A flaw has been found in Mayan EDMS up to 4.10.1. The impacted element is an unknown function of the file /authentication/. This manipulation causes open redir… |
CVE-2025-14451 | Medium | 4.7 | 2025-12-13 | The Solutions Ad Manager plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.0.0. This is due to insufficient validatio… |
CVE-2025-34504 | Medium | 6.1 | 2025-12-11 | KodExplorer 4.52 contains an open redirect vulnerability in the user login page that allows attackers to manipulate the 'link' parameter. Attackers can craft m… |
CVE-2025-67713 | Medium | 6.1 | 2025-12-11 | Miniflux 2 is an open source feed reader. Versions 2.2.14 and below treat redirect_url as safe when url.Parse(...).IsAbs() is false, enabling phishing flows af… |
CVE-2025-67502 | Medium | 5.4 | 2025-12-10 | Taguette is an open source qualitative research tool. In versions 1.5.1 and below, attackers can craft malicious URLs that redirect users to arbitrary externa… |
CVE-2025-67587 | Medium | 4.7 | 2025-12-09 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms FreshDesk Plugin gf-freshdesk allows Phishing.This issue affect… |
CVE-2025-67585 | Medium | 4.7 | 2025-12-09 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in flexmls Flexmls® IDX flexmls-idx allows Phishing.This issue affects Flexmls® IDX: from n/a… |
CVE-2025-11222 | Medium | 6.1 | 2025-12-04 | Central Dogma versions before 0.78.0 contain an Open Redirect vulnerability that allows attackers to redirect users to untrusted sites via specially crafted UR… |
CVE-2025-20382 | Low | 3.5 | 2025-12-03 | In Splunk Enterprise versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, and Splunk Cloud Platform versions below 10.1.2507.10, 10.0.2503.8, and 9.3.2411.120, a l… |
CVE-2025-58044 | Medium | 6.1 | 2025-12-01 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses… |
CVE-2025-13819 | Medium | 6.1 | 2025-12-01 | Open redirect in the web server component of MiR Robot and Fleet software allows a remote attacker to redirect users to arbitrary external websites via a craft… |
CVE-2025-66062 | Low | 3.4 | 2025-11-21 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Frank Goossens WP YouTube Lyte wp-youtube-lyte allows Phishing.This issue affects WP YouTu… |
CVE-2024-8527 | | 2025-11-19 | Open Redirect in URL parameter in Automated Logic WebCTRL and Carrier i-Vu versions 6.0, 6.5, 7.0, 8.0, 8.5, 9.0 may allow attackers to exploit user sessions. | |
CVE-2025-63828 | Medium | 6.1 | 2025-11-18 | Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to m… |
CVE-2025-40545 | Medium | 4.8 | 2025-11-18 | SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attacker could manipulate t… |
CVE-2024-13983 | Medium | 6.3 | 2025-11-14 | Inappropriate implementation in Lens in Google Chrome on iOS prior to 136.0.7103.59 allowed a remote attacker to perform UI spoofing via a crafted QR code. (Ch… |
CVE-2025-64754 | | 2025-11-13 | Jitsi Meet is an open source video conferencing application. A vulnerability present in versions prior to 2.0.10532 allows attackers to hijack the OAuth authen… | |
CVE-2025-20355 | Medium | 4.7 | 2025-11-13 | A vulnerability in the web-based management interface of Cisco Catalyst Center Virtual Appliance could allow an unauthenticated, remote attacker to redirect a… |
CVE-2025-64716 | | 2025-11-13 | Anubis is a Web AI Firewall Utility that challenges users' connections in order to protect upstream resources from scraper bots. Prior to version 1.23.0, when… | |
CVE-2025-20378 | Low | 3.1 | 2025-11-12 | In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, 9.2.9, and Splunk Cloud Platform versions below 10.0.2503.5, 9.3.2411.111, and 9.3.2408.121, an unaut… |
CVE-2025-42924 | Medium | 6.1 | 2025-11-11 | SAP S/4HANA landscape SAP E-Recruiting BSP allows an unauthenticated attacker to craft malicious links, when clicked the victim could be redirected to the page… |
CVE-2025-42893 | Medium | 6.1 | 2025-11-11 | Due to an Open Redirect vulnerability in SAP Business Connector, an unauthenticated attacker could craft a malicious URL that, if accessed by a victim, redirec… |
CVE-2025-64481 | | 2025-11-07 | Datasette is an open source multi-tool for exploring and publishing data. In versions 0.65.1 and below and 1.0a0 through 1.0a19, deployed instances of Datasett… | |
CVE-2025-63784 | Medium | 6.5 | 2025-11-07 | An Open Redirect vulnerability exists in the OAuth callback handler in file onlook/apps/web/client/src/app/auth/callback/route.ts in Onlook web application 0.2… |
CVE-2025-12789 | Medium | 6.1 | 2025-11-07 | A flaw was found in Red Hat Single Sign-On. This issue is an Open Redirect vulnerability that occurs during the logout process. The redirect_uri parameter asso… |
CVE-2025-64116 | Medium | 6.1 | 2025-10-30 | Movary is a web application to track, rate and explore your movie watch history. Prior to 0.69.0, the login page accepts a redirect parameter without validatio… |
CVE-2025-64115 | Medium | 6.1 | 2025-10-30 | Movary is a web application to track, rate and explore your movie watch history. Versions up to and including 0.68.0 use the HTTP Referer header value directly… |
CVE-2025-62266 | Medium | 6.1 | 2025-10-30 | By default, Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4.10… |
CVE-2025-50736 | Medium | 6.1 | 2025-10-30 | An open redirect vulnerability exists in Byaidu PDFMathTranslate v1.9.9 that allows attackers to craft URLs that cause the application to redirect users to arb… |
CVE-2025-64101 | High | 8.1 | 2025-10-29 | Zitadel is open-source identity infrastructure software. Prior to 4.6.0, 3.4.3, and 2.71.18, a potential vulnerability exists in ZITADEL's password reset mecha… |
CVE-2025-62253 | Medium | 6.1 | 2025-10-27 | Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3… |
CVE-2025-62981 | Medium | 4.7 | 2025-10-27 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Zoho CRM and Bigin gf-zoho allows Phishing.This issue affects W… |
CVE-2025-62716 | High | 8.1 | 2025-10-24 | Plane is open-source project management software. Prior to version 1.1.0, an open redirect vulnerability in the ?next_path query parameter allows attackers to… |
CVE-2025-10355 | | 2025-10-23 | Open redirection vulnerability in MOLGENIS EMX2 v11.14.0. This vulnerability allows an attacker to create a malicious URL using a manipulated redirection param… | |
CVE-2025-60151 | Medium | 4.7 | 2025-10-22 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms HubSpot gf-hubspot allows Phishing.This issue affects WP Gravit… |
CVE-2025-61753 | Medium | 6.1 | 2025-10-21 | Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Miscellaneous). Supported versions that are affected are 12.2.3-12.2.14… |
CVE-2025-62595 | Medium | 4.3 | 2025-10-21 | Koa is expressive middleware for Node.js using ES2017 async functions. In versions 2.16.2 to before 2.16.3 and 3.0.1 to before 3.0.3, a bypass to CVE-2025-8129… |
CVE-2025-62428 | | 2025-10-16 | Drawing-Captcha APP provides interactive, engaging verification for Web-Based Applications. The vulnerability is a Host Header Injection in the /register and /… | |
CVE-2025-62407 | Medium | 6.1 | 2025-10-16 | Frappe is a full-stack web application framework. Prior to 14.98.0 and 15.83.0, an open redirect was possible through the redirect argument on the login page… |
CVE-2025-62379 | Low | 3.1 | 2025-10-15 | Reflex is a library to build full-stack web apps in pure Python. In versions 0.5.4 through 0.8.14, the /auth-codespace endpoint automatically assigns the redir… |
CVE-2025-54196 | Medium | 4.3 | 2025-10-14 | Adobe Connect versions 12.9 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An attacker could leverage this vu… |
CVE-2025-47890 | Low | 2.6 | 2025-10-14 | An URL Redirection to Untrusted Site vulnerabilities [CWE-601] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2… |
CVE-2025-62361 | Medium | 6.1 | 2025-10-13 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.0, an Open Redirect vulnerability was identified i… |
CVE-2025-11167 | Medium | 4.7 | 2025-10-11 | The CM Registration – Tailored tool for seamless login and invitation-based registrations plugin for WordPress is vulnerable to Open Redirect in all versions u… |
CVE-2025-35059 | Medium | 4.3 | 2025-10-09 | Newforma Info Exchange (NIX) '/DownloadWeb/hyperlinkredirect.aspx' provides an unauthenticated URL redirect via the 'nhl' parameter. |
CVE-2025-0608 | Medium | 5.5 | 2025-10-06 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Logo Software Inc. Logo Cloud allows Phishing, Forceful Browsing. This issue affects Logo… |
CVE-2025-61606 | Medium | 6.1 | 2025-10-02 | WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an Open Redirect vulnerability, identified in th… |
CVE-2025-54088 | Medium | 6.1 | 2025-10-02 | CVE-2025-54088 is an open-redirect vulnerability in Secure Access prior to version 14.10. Attackers with access to the console can redirect victims to an arbit… |
CVE-2025-11240 | High | 7.2 | 2025-10-02 | An open redirect vulnerability existed in KNIME Business Hub prior to version 1.16.0. An unauthenticated remote attacker could craft a link to a legitimate KNI… |
CVE-2025-61587 | Medium | 6.1 | 2025-10-01 | Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter on .within.website when Weblate is confi… |
CVE-2024-55017 | High | 7.5 | 2025-09-30 | Account Takeover in Corezoid 6.6.0 in the OAuth2 implementation via an open redirect in the redirect_uri parameter allows attackers to intercept authorization… |
CVE-2025-57879 | Medium | 6.1 | 2025-09-29 | There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that c… |
CVE-2025-57878 | Medium | 6.1 | 2025-09-29 | There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that c… |
CVE-2025-57872 | Medium | 6.1 | 2025-09-29 | There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, unauthenticated attacker to craft a URL that c… |
CVE-2025-59426 | Medium | 4.3 | 2025-09-25 | Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.130.1, the project's OIDC redirect handling logic constructs the host an… |
CVE-2025-58006 | Medium | 4.7 | 2025-09-22 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft allows Phishing.This issue af… |
CVE-2025-7702 | Medium | 4.7 | 2025-09-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Pusula Communication Information Internet Industry and Trade Ltd. Co. Manageable Email Sen… |
CVE-2025-9084 | Low | 3.1 | 2025-09-15 | Mattermost versions 10.5.x <= 10.5.9 fail to properly validate redirect URLs which allows attackers to redirect users to malicious sites via crafted OAuth logi… |