CWE-601 · URL Redirection to Untrusted Site (Open Redirect) (page 5)
Page 5 of 17 — CVEs classified under CWE-601, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-9072 | High | 7.6 | 2025-09-15 | Mattermost versions 10.10.x <= 10.10.1, 10.5.x <= 10.5.9, 10.9.x <= 10.9.4 fail to validate the redirect_to parameter, allowing an attacker to craft a maliciou… |
CVE-2025-43795 | Medium | 6.1 | 2025-09-12 | Open redirect vulnerability in the System Settings in Liferay Portal 7.1.0 through 7.4.3.101, and Liferay DXP 2023.Q3.1 through 2023.Q3.4 , 7.4 GA through upda… |
CVE-2025-10229 | Medium | 4.3 | 2025-09-10 | A vulnerability has been found in Freshwork up to 1.2.3. This impacts an unknown function of the file /api/v2/logout. Such manipulation of the argument post_lo… |
CVE-2025-57665 | Medium | 6.4 | 2025-09-09 | Element Plus Link component (el-link) through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that… |
CVE-2025-39523 | Medium | 4.7 | 2025-09-09 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in GoodBarber GoodBarber goodbarber.This issue affects GoodBarber: from n/a through <= 1.0.26. |
CVE-2025-59013 | Medium | 6.1 | 2025-09-09 | An open‑redirect vulnerability in GeneralUtility::sanitizeLocalUrl of TYPO3 CMS 9.0.0–9.5.54, 10.0.0–10.4.53, 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.1… |
CVE-2025-20291 | Medium | 4.3 | 2025-09-03 | A vulnerability in Cisco Webex Meetings could have allowed an unauthenticated, remote attacker to redirect a targeted Webex Meetings user to an untrusted websi… |
CVE-2024-12924 | Medium | 6.3 | 2025-09-01 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Akınsoft QR Menü allows Forceful Browsing, Phishing. This issue affects QR Menü: from s1… |
CVE-2025-58067 | Medium | 4.2 | 2025-08-29 | Basecamp's Google Sign-In adds Google sign-in to Rails applications. Prior to version 1.3.1, it is possible to redirect a user to another origin if the "procee… |
CVE-2025-58204 | Medium | 4.7 | 2025-08-27 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress allows Phis… |
CVE-2025-57821 | Medium | 4.2 | 2025-08-27 | Basecamp's Google Sign-In adds Google sign-in to Rails applications. Prior to version 1.3.0, it is possible to craft a malformed URL that passes the "same orig… |
CVE-2025-20317 | High | 7.1 | 2025-08-27 | A vulnerability in the Virtual Keyboard Video Monitor (vKVM) connection handling of Cisco Integrated Management Controller (IMC) could allow an unauthenticated… |
CVE-2025-2697 | High | 7.4 | 2025-08-26 | IBM Cognos Command Center 10.2.4.1 and 10.2.5 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victi… |
CVE-2025-52219 | Medium | 6.5 | 2025-08-26 | SelectZero SelectZero Data Observability Platform before 2025.5.2 contains an Open Redirect vulnerability. Legacy UI fields can be used to create arbitrary ext… |
CVE-2025-43767 | Medium | 6.1 | 2025-08-23 | Open Redirect vulnerability in /c/portal/edit_info_item parameter redirect in Liferay Portal 7.4.3.86 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024… |
CVE-2025-57800 | High | 8.8 | 2025-08-22 | Audiobookshelf is an open-source self-hosted audiobook server. In versions 2.6.0 through 2.26.3, the application does not properly restrict redirect callback U… |
CVE-2025-55625 | Medium | 6.3 | 2025-08-22 | An open redirect vulnerability in Reolink v4.54.0.4.20250526 allows attackers to redirect users to a malicious site via a crafted URL. NOTE: this is disputed b… |
CVE-2025-55624 | Medium | 5.3 | 2025-08-22 | An intent redirection vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access internal functions or access non-public components. |
CVE-2025-55751 | | 2025-08-20 | OnboardLite is the result of the Influx Initiative, our vision for an improved student organization lifecycle at the University of Central Florida. An attacker… | |
CVE-2025-7777 | Medium | 6.5 | 2025-08-20 | The mirror-registry doesn't properly sanitize the host header HTTP header in HTTP request received, allowing an attacker to perform malicious redirects to atta… |
CVE-2025-55706 | Medium | 4.3 | 2025-08-20 | URL redirection to untrusted site ('Open Redirect') issue exists in Movable Type. If this vulnerability is exploited, an invalid parameter may be inserted int… |
CVE-2025-9193 | Low | 3.5 | 2025-08-20 | A flaw has been found in TOTVS Portal Meu RH up to 12.1.17. Impacted is an unknown function of the component Password Reset Handler. Executing manipulation of… |
CVE-2025-55032 | Medium | 6.1 | 2025-08-19 | Focus for iOS would not respect a Content-Disposition header of type Attachment and would incorrectly display the content inline, potentially allowing for XSS… |
CVE-2025-55031 | Critical | 9.8 | 2025-08-19 | Malicious pages could use Firefox for iOS to pass FIDO: links to the OS and trigger the hybrid passkey transport. An attacker within Bluetooth range could have… |
CVE-2025-54145 | Critical | 9.1 | 2025-08-19 | The QR scanner could allow arbitrary websites to be opened if a user was tricked into scanning a malicious link that leveraged Firefox's open-text URL scheme… |
CVE-2025-54144 | Medium | 5.4 | 2025-08-19 | The URL scheme used by Firefox to facilitate searching of text queries could incorrectly allow attackers to open arbitrary website URLs or internal pages if a… |
CVE-2025-8066 | | 2025-08-15 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Bunkerity Bunker Web on Linux allows Phishing.This issue affects Bunker Web: 1.6.2. | |
CVE-2025-55207 | | 2025-08-15 | Astro is a web framework for content-driven websites. Following CVE-2025-54793 there's still an Open Redirect vulnerability in a subset of Astro deployment sce… | |
CVE-2025-54681 | Medium | 4.7 | 2025-08-14 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Connector for Gravity Forms and Google Sheets wp-gravity-forms-spreadsheets allo… |
CVE-2025-55166 | | 2025-08-12 | savg-sanitizer is a PHP SVG/XML sanitizer. Prior to version 0.22.0, the sanitization logic in the cleanXlinkHrefs method only searches for lower-case attribute… | |
CVE-2025-8813 | Low | 3.5 | 2025-08-10 | A vulnerability has been found in atjiu pybbs up to 6.0.0 and classified as problematic. This vulnerability affects the function changeLanguage of the file src… |
CVE-2025-8737 | Low | 3.5 | 2025-08-08 | A vulnerability, which was classified as problematic, was found in zlt2000 microservices-platform up to 6.0.0. This affects the function onLogoutSuccess of the… |
CVE-2025-54793 | Medium | 6.1 | 2025-08-08 | Astro is a web framework for content-driven websites. In versions 5.2.0 through 5.12.7, there is an Open Redirect vulnerability in the trailing slash redirecti… |
CVE-2025-2824 | High | 7.4 | 2025-08-01 | IBM Operational Decision Manager 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, and 9.5.0 could allow a remote attacker to conduct phishing attacks, using an open redi… |
CVE-2024-34328 | Medium | 6.3 | 2025-07-31 | An open redirect in Sielox AnyWare v2.1.2 allows attackers to execute a man-in-the-middle attack via a crafted URL. |
CVE-2025-50578 | Critical | 9.8 | 2025-07-30 | LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, specifically `X-Forwarded-Host` and `Referer`. An un… |
CVE-2025-52897 | Medium | 6.5 | 2025-07-30 | GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious link to attempt a phis… |
CVE-2025-54414 | | 2025-07-26 | Anubis is a Web AI Firewall Utility that weighs the soul of users' connections using one or more challenges in order to protect upstream resources from scraper… | |
CVE-2025-8129 | Low | 3.5 | 2025-07-25 | A vulnerability, which was classified as problematic, was found in KoaJS Koa up to 3.0.0. Affected is the function back in the library lib/response.js of the c… |
CVE-2025-44109 | Medium | 5.4 | 2025-07-23 | A URL redirection in Pinokio v3.6.23 allows attackers to redirect victim users to attacker-controlled pages. |
CVE-2025-50477 | Medium | 5.4 | 2025-07-23 | A URL redirection in lbry-desktop v0.53.9 allows attackers to redirect victim users to attacker-controlled pages. |
CVE-2025-4296 | Medium | 4.7 | 2025-07-23 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in HotelRunner B2B allows Forceful Browsing. This issue affects B2B: before 04.06.2025. |
CVE-2025-7953 | Low | 3.5 | 2025-07-22 | A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS up to 5.202506.a. This issue affects some unknown processing of the f… |
CVE-2025-7949 | Low | 3.5 | 2025-07-22 | A vulnerability was found in Sanluan PublicCMS up to 5.202506.a. It has been declared as problematic. Affected by this vulnerability is an unknown functionalit… |
CVE-2025-7863 | Low | 3.5 | 2025-07-20 | A vulnerability was found in thinkgem JeeSite up to 5.12.0 and classified as problematic. Affected by this issue is the function redirectUrl of the file src/ma… |
CVE-2025-7785 | Medium | 4.3 | 2025-07-18 | A vulnerability classified as problematic was found in thinkgem JeeSite up to 5.12.0. This vulnerability affects the function sso of the file src/main/java/com… |
CVE-2025-6197 | Medium | 4.2 | 2025-07-18 | An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation: - Multiple organizat… |
CVE-2025-6023 | High | 7.6 | 2025-07-18 | An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11… |
CVE-2025-7763 | Medium | 4.3 | 2025-07-17 | A vulnerability, which was classified as problematic, was found in thinkgem JeeSite up to 5.12.0. Affected is the function select of the file src/main/java/com… |
CVE-2025-54066 | Medium | 4.7 | 2025-07-17 | DiracX-Web is a web application that provides an interface to interact with the DiracX services. Prior to version 0.1.0-a8, an attacker can forge a request tha… |
CVE-2025-50067 | Critical | 9.0 | 2025-07-15 | Vulnerability in Oracle Application Express (component: Strategic Planner Starter App). Supported versions that are affected are 24.2.4 and 24.2.5. Easily ex… |
CVE-2025-53821 | Medium | 4.7 | 2025-07-14 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. An Open Redirect vulnerability exists in the web appli… |
CVE-2025-42985 | Medium | 6.1 | 2025-07-08 | Due to insufficient sanitization in the SAP BusinessObjects Content Administrator Workbench, attackers could craft malicious URLs and execute scripts in a vict… |
CVE-2025-42981 | Medium | 6.1 | 2025-07-08 | Due to an open redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft a URL link embedding a malicious script… |
CVE-2025-53535 | | 2025-07-07 | Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affect… | |
CVE-2024-37658 | Medium | 6.1 | 2025-07-07 | An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the bbs/member_confirm.php. |
CVE-2024-37657 | Medium | 6.1 | 2025-07-07 | An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via thebbs/login.php component. |
CVE-2024-37656 | Medium | 6.1 | 2025-07-07 | An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the insufficient URL parameter verification i… |
CVE-2025-6238 | High | 8.0 | 2025-07-04 | The AI Engine plugin for WordPress is vulnerable to open redirect in version 2.8.4. This is due to an insecure OAuth implementation, as the 'redirect_uri' para… |
CVE-2025-49592 | Medium | 4.6 | 2025-06-26 | n8n is a workflow automation platform. Versions prior to 1.98.0 have an Open Redirect vulnerability in the login flow. Authenticated users can be redirected to… |
CVE-2025-6701 | Low | 3.5 | 2025-06-26 | A vulnerability, which was classified as problematic, has been found in Xuxueli xxl-sso 1.1.0. This issue affects some unknown processing of the file /xxl-sso-… |
CVE-2025-25012 | Medium | 4.3 | 2025-06-25 | URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a speciall… |
CVE-2025-6428 | Medium | 4.3 | 2025-06-24 | When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing… |
CVE-2025-6552 | Medium | 4.3 | 2025-06-24 | A vulnerability was found in java-aodeng Hope-Boot 1.0.0. It has been classified as problematic. Affected is the function doLogin of the file /src/main/java/co… |
CVE-2025-36016 | Medium | 6.8 | 2025-06-21 | IBM Process Mining 2.0.1 IF001 and 2.0.1 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to vi… |
CVE-2025-52552 | Medium | 6.1 | 2025-06-21 | FastGPT is an AI Agent building platform. Prior to version 4.9.12, the LastRoute Parameter on login page is vulnerable to open redirect and DOM-based XSS. Impr… |
CVE-2025-6286 | Low | 3.5 | 2025-06-19 | A vulnerability classified as problematic has been found in PHPGurukul COVID19 Testing Management System 2021. Affected is an unknown function of the file /sea… |
CVE-2025-50182 | Medium | 5.3 | 2025-06-19 | urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Nod… |
CVE-2025-50181 | Medium | 5.3 | 2025-06-19 | urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager… |
CVE-2025-49868 | Medium | 4.7 | 2025-06-17 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Phishing.This issue affects Fun… |
CVE-2025-2091 | Medium | 5.4 | 2025-06-16 | An open redirection vulnerability in M-Files mobile applications for Android and iOS prior to version 25.6.0 allows attackers to use maliciously crafted PDF fi… |
CVE-2025-6089 | Medium | 4.3 | 2025-06-15 | A vulnerability has been found in Astun Technology iShare Maps 5.4.0 and classified as problematic. This vulnerability affects unknown code of the file atCheck… |
CVE-2025-26394 | Medium | 4.8 | 2025-06-10 | SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attacker could manipulate… |
CVE-2025-49325 | Medium | 4.7 | 2025-06-06 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Automattic Newspack Newsletters newspack-newsletters allows Phishing.This issue affects Ne… |
CVE-2025-30954 | Medium | 4.7 | 2025-06-06 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Constant Contact Plugin gf-constant-contact allows Phishing.Thi… |
CVE-2025-30953 | Medium | 4.7 | 2025-06-06 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Salesforce gf-salesforce-crmperks allows Phishing.This issue af… |
CVE-2024-1440 | Medium | 5.4 | 2025-06-02 | An open redirection vulnerability exists in multiple WSO2 products due to improper validation of the multi-option URL in the authentication endpoint when multi… |
CVE-2025-48936 | High | 8.1 | 2025-05-30 | Zitadel is open-source identity infrastructure software. Prior to versions 2.70.12, 2.71.10, and 3.2.2, a potential vulnerability exists in the password reset… |
CVE-2025-5256 | Medium | 5.4 | 2025-05-28 | SummaryThis advisory addresses an Open Redirection vulnerability in Mautic's user unlocking endpoint. This vulnerability could be exploited by an attacker to r… |
CVE-2025-5183 | Low | 3.5 | 2025-05-26 | A vulnerability was found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1 and classified as problematic. This issue affects some unknown… |
CVE-2025-23183 | Medium | 6.1 | 2025-05-22 | CWE-601: URL Redirection to Untrusted Site ('Open Redirect') |
CVE-2025-4123 | High | 7.6 | 2025-05-22 | A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect u… |
CVE-2024-12561 | Medium | 6.1 | 2025-05-21 | The Affiliate Sales in Google Analytics and other tools plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 2.0.0. This i… |
CVE-2025-47854 | Medium | 4.3 | 2025-05-20 | In JetBrains TeamCity before 2025.03.2 open redirect was possible on editing VCS Root page |
CVE-2025-4838 | Medium | 4.3 | 2025-05-17 | A vulnerability, which was classified as problematic, was found in kanwangzjm Funiture up to 71ca0fb0658b3d839d9e049ac36429207f05329b. Affected is the function… |
CVE-2025-32962 | Medium | 4.3 | 2025-05-16 | Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 4.6.2 would allow for a malicious unauthenticated actor to pe… |
CVE-2025-40630 | Medium | 6.1 | 2025-05-16 | Open redirection vulnerability in IceWarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to redirect a user to any domain by sendi… |
CVE-2025-47789 | Medium | 6.1 | 2025-05-15 | Horilla is a free and open source Human Resource Management System (HRMS). In versions up to and including 1.3, an attacker can craft a Horilla URL that refers… |
CVE-2024-6690 | Medium | 6.1 | 2025-05-15 | The wccp-pro WordPress plugin before 15.3 contains an open-redirect flaw via the referrer parameter, allowing redirection of users to external sites |
CVE-2023-6786 | Medium | 6.1 | 2025-05-15 | The Payment Gateway for Telcell WordPress plugin through 2.0.1 does not validate the api_url parameter before redirecting the user to its value, leading to an… |
CVE-2025-30010 | Medium | 6.1 | 2025-05-13 | The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an… |
CVE-2025-4513 | Medium | 4.3 | 2025-05-10 | A vulnerability classified as problematic was found in Catalyst User Key Authentication Plugin 20220819 on Moodle. Affected by this vulnerability is an unknown… |
CVE-2025-40846 | | 2025-05-08 | Improper Input Validation, the returnUrl parameter in Account Security Settings lacks proper input validation, allowing attackers to redirect users to maliciou… | |
CVE-2025-46826 | | 2025-05-07 | insa-auth is an authentication server for INSA Rouen. A minor issue allowed third-party websites to access the server's secondary authentication bridge, potent… | |
CVE-2025-47644 | Medium | 4.7 | 2025-05-07 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in formsintegrations Integrations of Zoho CRM with Elementor form integrations-of-zoho-crm-wi… |
CVE-2025-47456 | Medium | 4.7 | 2025-05-07 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Zendesk gf-zendesk allows Phishing.This issue affects WP Gravit… |
CVE-2025-47455 | Medium | 4.7 | 2025-05-07 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and Salesforce woo-salesforce-plugin-crm-perks allow… |
CVE-2025-47454 | Medium | 4.7 | 2025-05-07 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Dynamics CRM gf-dynamics-crm allows Phishing.This issue affects… |
CVE-2025-4328 | Low | 3.5 | 2025-05-06 | A vulnerability was found in fp2952 spring-cloud-base up to 7f050dc6db9afab82c5ce1d41cd74ed255ec9bfa. It has been declared as problematic. Affected by this vul… |
CVE-2025-46553 | Medium | 6.1 | 2025-05-05 | @misskey-dev/summaly is a tool for getting a summary of a web page. Starting in version 3.0.1 and prior to version 5.2.1, a logic error in the main `summaly` f… |