CWE-601 · URL Redirection to Untrusted Site (Open Redirect) (page 6)
Page 6 of 17 — CVEs classified under CWE-601, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-4143 | Medium | 6.1 | 2025-05-01 | The OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp , did not correctly validate that r… |
CVE-2025-3859 | Medium | 6.1 | 2025-04-30 | Websites directing users to long URLs that caused eliding to occur in the location view could leverage the truncating behavior to potentially trick users into… |
CVE-2025-32970 | Medium | 6.1 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 13.5-rc-1 to before 15.10.13, from 16.0.0-rc-1 to before 16.4.4, and from 16.5.0-rc-1 to before 16… |
CVE-2025-2068 | Medium | 5.0 | 2025-04-25 | An open redirect vulnerability was reported in the FileZ client that could allow information disclosure if a crafted url is visited by a local user. |
CVE-2025-39404 | Medium | 4.7 | 2025-04-24 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Heateor Support Sassy Social Share sassy-social-share allows Phishing.This issue affects S… |
CVE-2020-36845 | Medium | 5.3 | 2025-04-20 | The KnowBe4 Security Awareness Training application before 2020-01-10 contains a redirect function that does not validate the destination URL before redirectin… |
CVE-2025-39599 | Medium | 4.7 | 2025-04-16 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Webilia Inc. Listdom listdom allows Phishing.This issue affects Listdom: from n/a through… |
CVE-2025-39597 | Medium | 4.7 | 2025-04-16 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Arthur Yarwood Fast eBay Listings fast-ebay-listings allows Phishing.This issue affects Fa… |
CVE-2025-3522 | Medium | 6.3 | 2025-04-15 | Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird a… |
CVE-2025-31491 | High | 8.6 | 2025-04-15 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to 0.6.1… |
CVE-2024-49706 | Medium | 6.1 | 2025-04-14 | Internet Starter, one of SoftCOM iKSORIS system modules, is vulnerable to Open Redirect attacks by including base64 encoded URLs in the target parameter sent i… |
CVE-2025-32694 | Medium | 4.7 | 2025-04-09 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Phishing.This issue affects Ultimate W… |
CVE-2025-32693 | Medium | 4.7 | 2025-04-09 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Phishing.This issue affects WebinarPr… |
CVE-2025-3433 | Medium | 6.1 | 2025-04-08 | The Advanced Advertising System plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.3.1. This is due to insufficient va… |
CVE-2025-3155 | High | 7.4 | 2025-04-03 | A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to i… |
CVE-2025-31871 | Medium | 4.7 | 2025-04-01 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Galaxy Weblinks WP Clone any post type wp-clone-any-post-type allows Phishing.This issue a… |
CVE-2025-31821 | Medium | 4.7 | 2025-04-01 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in formsintegrations Integration of Zoho CRM and Contact Form 7 allows Phishing. This issue a… |
CVE-2025-24180 | High | 8.1 | 2025-03-31 | The issue was addressed with improved input validation. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4, watchOS… |
CVE-2025-3027 | Medium | 6.1 | 2025-03-31 | The vulnerability exists in the EJBCA service, version 8.0 Enterprise. By making a small change to the PATH of the URL associated with the service, the server… |
CVE-2025-2980 | Low | 3.5 | 2025-03-31 | A vulnerability classified as problematic was found in Legrand SMS PowerView 1.x. This vulnerability affects unknown code. The manipulation of the argument red… |
CVE-2025-24381 | High | 8.8 | 2025-03-28 | Dell Unity, version(s) 5.4 and prior, contain(s) an URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An unauthenticated attacker with remote… |
CVE-2025-30885 | Medium | 4.7 | 2025-03-27 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Bit Apps Bit Form bit-form allows Phishing.This issue affects Bit Form: from n/a through <… |
CVE-2025-30884 | Medium | 4.7 | 2025-03-27 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Bit Apps Bit Integrations bit-integrations allows Phishing.This issue affects Bit Integrat… |
CVE-2025-30859 | Medium | 4.7 | 2025-03-27 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in guru-aliexpress AliNext ali2woo-lite allows Phishing.This issue affects AliNext: from n/a… |
CVE-2025-30795 | Medium | 4.7 | 2025-03-27 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Phishing.This issue affects Fun… |
CVE-2025-30781 | Medium | 4.7 | 2025-03-27 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WPFactory Scheduled & Automatic Order Status Controller for WooCommerce order-status-rules… |
CVE-2025-30164 | Medium | 4.1 | 2025-03-26 | Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 vulnerab… |
CVE-2025-27888 | Medium | 5.4 | 2025-03-20 | Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), U… |
CVE-2024-9308 | Medium | 6.1 | 2025-03-20 | An open redirect vulnerability in haotian-liu/llava version v1.2.0 (LLaVA-1.6) allows a remote unauthenticated attacker to redirect users to arbitrary websites… |
CVE-2024-8021 | Medium | 6.1 | 2025-03-20 | An open redirect vulnerability exists in the latest version of gradio-app/gradio. The vulnerability allows an attacker to redirect users to a malicious website… |
CVE-2024-11044 | Medium | 6.1 | 2025-03-20 | An open redirect vulnerability in automatic1111/stable-diffusion-webui version 1.10.0 allows a remote unauthenticated attacker to redirect users to arbitrary w… |
CVE-2024-10908 | Medium | 6.1 | 2025-03-20 | An open redirect vulnerability in lm-sys/fastchat Release v0.2.36 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specia… |
CVE-2024-10812 | Medium | 6.1 | 2025-03-20 | An open redirect vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability occurs when a user is redirected to a URL specified by user-… |
CVE-2025-21104 | Medium | 4.3 | 2025-03-13 | Dell NetWorker, versions prior to 19.11.0.4 and version 19.12, contains an URL Redirection to Untrusted Site ('Open Redirect') Vulnerability in NetWorker Manag… |
CVE-2025-28896 | Medium | 4.7 | 2025-03-11 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Akshar Soft Solutions AS English Admin as-english-admin allows Phishing.This issue affects… |
CVE-2024-51321 | High | 7.6 | 2025-03-11 | In Zucchetti Ad Hoc Infinity 2.4, an improper check on the m_cURL parameter allows an attacker to redirect the victim to an attacker-controlled website after t… |
CVE-2025-27625 | Medium | 4.3 | 2025-03-05 | In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash (`\`) characters are considered safe, allowing attackers to perform ph… |
CVE-2025-27426 | Medium | 5.4 | 2025-03-04 | Malicious websites utilizing a server-side redirect to an internal error page could result in a spoofed website URL. This vulnerability was fixed in Firefox fo… |
CVE-2025-27424 | Medium | 4.3 | 2025-03-04 | Websites redirecting to a non-HTTP scheme URL could allow a website address to be spoofed for a malicious page. This vulnerability was fixed in Firefox for iOS… |
CVE-2025-1300 | Medium | 6.1 | 2025-02-28 | CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. The CodeChecker web server contains an… |
CVE-2024-54957 | Medium | 6.1 | 2025-02-27 | Nagios XI 2024R1.2.2 is vulnerable to an open redirect flaw on the Tools page, exploitable by users with read-only permissions. This vulnerability allows an at… |
CVE-2024-11955 | Medium | 4.3 | 2025-02-25 | A vulnerability was found in GLPI up to 10.0.17. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /i… |
CVE-2025-27143 | Medium | 6.1 | 2025-02-24 | Better Auth is an authentication and authorization library for TypeScript. Prior to version 1.1.21, the application is vulnerable to an open redirect due to im… |
CVE-2025-1488 | Medium | 4.7 | 2025-02-24 | The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 3.2. This is due to insuffici… |
CVE-2024-13888 | High | 7.2 | 2025-02-20 | The WPMobile.App plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 11.56. This is due to insufficient validation on the… |
CVE-2025-25300 | | 2025-02-18 | smartbanner.js is a customizable smart app banner for iOS and Android. Prior to version 1.14.1, clicking on smartbanner `View` link and navigating to 3rd party… | |
CVE-2025-1269 | Medium | 4.8 | 2025-02-18 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in HAVELSAN Liman MYS allows Cross-Site Flashing. This issue affects Liman MYS: before 2.1.1… |
CVE-2025-21401 | Medium | 4.5 | 2025-02-15 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability |
CVE-2025-25198 | High | 7.1 | 2025-02-12 | mailcow: dockerized is an open source groupware/email suite based on docker. Prior to version 2025-01a, a vulnerability in mailcow's password reset functionali… |
CVE-2024-57241 | Medium | 6.5 | 2025-02-11 | Dedecms 5.71sp1 and earlier is vulnerable to URL redirect. In the web application, a logic error does not judge the input GET request resulting in URL redirect… |
CVE-2025-23363 | High | 7.4 | 2025-02-11 | A vulnerability has been identified in Teamcenter V14.1 (All versions), Teamcenter V14.2 (All versions), Teamcenter V14.3 (All versions < V14.3.0.14), Teamcent… |
CVE-2025-24868 | High | 7.1 | 2025-02-11 | The User Account and Authentication service (UAA) for SAP HANA extended application services, advanced model (SAP HANA XS advanced model) allows an unauthentic… |
CVE-2025-0970 | Medium | 4.3 | 2025-02-02 | A vulnerability was found in Zenvia Movidesk up to 25.01.22. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of… |
CVE-2024-54728 | Medium | 6.5 | 2025-01-27 | Incorrect access control in BYD QIN PLUS DM-i Dilink OS 3.0_13.1.7.2204050.1 allows unauthorized attackers to access system logcat logs. |
CVE-2024-56972 | Medium | 6.5 | 2025-01-27 | An issue in Midea Group Co., Ltd Midea Home iOS 9.3.12 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56971 | Medium | 6.5 | 2025-01-27 | An issue in Zhiyuan Yuedu (Guangzhou) Literature Information Technology Co., Ltd Shuqi Novel iOS 5.3.8 allows attackers to access sensitive user information vi… |
CVE-2024-56969 | Medium | 6.5 | 2025-01-27 | An issue in Pixocial Technology (Singapore) Pte. Ltd BeautyPlus iOS 7.8.010 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56968 | Medium | 6.5 | 2025-01-27 | An issue in Shenzhen Intellirocks Tech Co. Ltd Govee Home iOS 6.5.01 allows attackers to access sensitive user information via supplying a crafted payload. |
CVE-2024-56967 | Medium | 6.5 | 2025-01-27 | An issue in Cloud Whale Interactive Technology LLC. PolyBuzz iOS 2.0.20 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56966 | Medium | 6.5 | 2025-01-27 | An issue in Shanghai Xuan Ting Entertainment Information & Technology Co., Ltd Qidian Reader iOS 5.9.384 allows attackers to access sensitive user information… |
CVE-2024-56965 | Medium | 6.5 | 2025-01-27 | An issue in Shanghai Shizhi Information Technology Co., Ltd Shihuo iOS 8.16.0 allows attackers to access sensitive user information via supplying a crafted lin… |
CVE-2024-56964 | Medium | 6.5 | 2025-01-27 | An issue in Che Hao Duo Used Automobile Agency (Beijing) Co., Ltd Guazi Used Car iOS 10.15.1 allows attackers to access sensitive user information via supplyin… |
CVE-2024-56963 | Medium | 6.5 | 2025-01-27 | An issue in Beijing Sogou Technology Development Co., Ltd Sogou Input iOS 12.2.0 allows attackers to access sensitive user information via supplying a crafted… |
CVE-2024-56962 | Medium | 6.5 | 2025-01-27 | An issue in Tencent Technology (Shanghai) Co., Ltd WeSing iOS v9.3.39 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56960 | Medium | 6.5 | 2025-01-27 | An issue in Tianjin Xiaowu Information technology Co., Ltd BeiKe Holdings iOS 1.3.50 allows attackers to access sensitive user information via supplying a craf… |
CVE-2024-56959 | Medium | 6.5 | 2025-01-27 | An issue in Mashang Consumer Finance Co., Ltd Anyihua iOS 3.6.2 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56957 | Medium | 6.5 | 2025-01-27 | An issue in Kingsoft Office Software Corporation Limited WPS Office iOS 12.20.0 allows attackers to access sensitive user information via supplying a crafted l… |
CVE-2024-56955 | Medium | 6.5 | 2025-01-27 | An issue in Tencent Technology (Shenzhen) Company Limited QQMail iOS 6.6.4 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56954 | Medium | 6.5 | 2025-01-27 | An issue in Beijing Baidu Netcom Science & Technology Co Ltd Haokan Video iOS 7.70.0 allows attackers to access sensitive user information via supplying a craf… |
CVE-2024-56953 | Medium | 6.5 | 2025-01-27 | An issue in Baidu (China) Co Ltd Baidu Input Method (iOS version) v12.6.13 allows attackers to access user information via supplying a crafted link. |
CVE-2024-56952 | Medium | 6.5 | 2025-01-27 | An issue in Beijing Baidu Netcom Science & Technology Co Ltd Baidu Lite app (iOS version) 6.40.0 allows attackers to access user information via supplying a cr… |
CVE-2024-56951 | Medium | 6.5 | 2025-01-27 | An issue in Hangzhou Bobo Technology Co Ltd UU Game Booster iOS 10.6.13 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56950 | Medium | 6.5 | 2025-01-27 | An issue in KuGou Technology Co., Ltd KuGou Concept iOS 4.0.61 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56949 | Medium | 6.5 | 2025-01-27 | An issue in Guangzhou Polar Future Culture Technology Co., Ltd University Search iOS 2.27.0 allows attackers to access sensitive user information via supplying… |
CVE-2024-56948 | Medium | 6.5 | 2025-01-27 | An issue in KuGou Technology CO. LTD KuGou Music iOS v20.0.0 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2024-56947 | Medium | 6.5 | 2025-01-27 | An issue in Xiamen Meitu Technology Co., Ltd. BeautyCam iOS v12.3.60 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2025-24741 | Medium | 4.7 | 2025-01-27 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in LOGON KB Support kb-support.This issue affects KB Support: from n/a through <= 1.6.7. |
CVE-2025-24740 | Medium | 4.7 | 2025-01-27 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ThimPress LearnPress learnpress.This issue affects LearnPress: from n/a through <= 4.2.7.1. |
CVE-2025-0705 | Medium | 4.3 | 2025-01-24 | A vulnerability has been found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d and classified as problematic. Affected by this vulnerabili… |
CVE-2025-21512 | Medium | 6.1 | 2025-01-21 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior… |
CVE-2025-24020 | Medium | 6.1 | 2025-01-21 | WeGIA is a Web manager for charitable institutions. An Open Redirect vulnerability was identified in the `control.php` endpoint of versions up to and including… |
CVE-2025-23086 | Medium | 6.1 | 2025-01-21 | On most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a feature to show a site's origin on the OS-provided file selector dialog when a site… |
CVE-2024-55892 | Medium | 4.8 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. Applications that use `TYPO3\CMS\Core\Http\Uri` to parse externally provided URLs (e.g., via a qu… |
CVE-2024-46481 | High | 7.2 | 2025-01-13 | The login page of Venki Supravizio BPM up to 18.1.1 is vulnerable to open redirect leading to reflected XSS. |
CVE-2024-53995 | | 2025-01-08 | SickChill is an automatic video library manager for TV shows. A user-controlled `login` endpoint's `next_` parameter takes arbitrary content. Prior to commit c… | |
CVE-2025-0244 | Medium | 5.3 | 2025-01-07 | When redirecting to an invalid protocol scheme, an attacker could spoof the address bar. *Note: This issue only affected Android operating systems. Other oper… |
CVE-2024-56734 | Medium | 6.1 | 2024-12-30 | Better Auth is an authentication library for TypeScript. An open redirect vulnerability has been identified in the verify email endpoint of all versions of Bet… |
CVE-2024-12990 | Medium | 4.3 | 2024-12-27 | A vulnerability was found in ruifang-tech Rebuild 3.8.6. It has been classified as problematic. This affects an unknown part of the file /user/admin-verify of… |
CVE-2024-45082 | Medium | 6.8 | 2024-12-18 | IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3 could allow a remote attacker to conduct phishing attacks, using an open redirect attack… |
CVE-2024-55452 | Medium | 5.4 | 2024-12-16 | A URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs in the upload and rendering of new block / carousel items. This vulner… |
CVE-2024-9387 | Medium | 6.4 | 2024-12-12 | An issue was discovered in GitLab CE/EE affecting all versions from 11.8 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. An attacker could potential… |
CVE-2024-11274 | High | 8.7 | 2024-12-12 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 p… |
CVE-2024-54051 | Medium | 6.1 | 2024-12-10 | Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An attacker could leverage… |
CVE-2024-54050 | Medium | 6.1 | 2024-12-10 | Adobe Connect versions 12.6, 11.4.7 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An attacker could leverage… |
CVE-2024-38485 | Medium | 4.3 | 2024-12-09 | Dell ECS, versions prior to 3.8.0, contain(s) a Host Header Injection Vulnerability. A remote low-privileged attacker could potentially exploit this vulnerabil… |
CVE-2024-54255 | Medium | 4.7 | 2024-12-09 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in aviplugins.com Login Widget With Shortcode login-sidebar-widget allows Phishing.This issue… |
CVE-2024-52003 | Medium | 6.1 | 2024-11-29 | Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. There is a vulnerability in Traefik that allows the client to provide the X-Forwarded-… |
CVE-2024-53264 | | 2024-11-27 | bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). A open redirect vulnerability exists in the loading endpoint, allowing attacker… | |
CVE-2024-8526 | | 2024-11-21 | A vulnerability in Automated Logic WebCTRL 7.0 could allow an attacker to send a maliciously crafted URL, which when visited by an authenticated WebCTRL user… | |
CVE-2024-52512 | Low | 3.3 | 2024-11-15 | user_oidc app is an OpenID Connect user backend for Nextcloud. A malicious user could send a malformed login link that would redirect the user to a provided UR… |