CWE-601

Low likelihood

URL Redirection to Untrusted Site ('Open Redirect')

Parent: CWE-610 - Externally Controlled Reference to a Resource in Another Sphere

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

1,631 vulnerabilities with CWE-601

CVE-2025-62428 HIGH

Drawing-Captcha APP - Host Header Injection

CVE-2025-62407 MEDIUM

frappe < 14.98.0 - Open Redirect via Login Page Redirect Argument

CVSS 6.1

CVE-2025-62379 LOW

Reflex 0.5.4-0.8.14 - Open Redirect via /auth-codespace Endpoint

CVSS 3.1

CVE-2025-54196 MEDIUM

Adobe Connect < 12.9 - Open Redirect

CVSS 4.3

CVE-2025-47890 LOW

Fortinet FortiOS 6.4.0-7.6.3, FortiProxy 7.0.0-7.6.3, FortiSASE 25.2.a - Open Redirect via Crafted HTTP Requests

CVSS 2.6

CVE-2025-62361 MEDIUM

WeGIA < 3.5.0 - Open Redirect via control.php nextPage Parameter

CVSS 6.1

CVE-2025-11167 MEDIUM

CM Registration < 2.5.6 - Unauthenticated Open Redirect via redirect_url Parameter

CVSS 4.7

CVE-2025-35059 MEDIUM

Newforma Project Center < 2024.1 - Unauthenticated Open Redirect via nhl Parameter

CVSS 4.3

CVE-2025-0608 MEDIUM

Logo Cloud <2025.R6 - Open Redirect

CVSS 5.5

CVE-2025-61606 MEDIUM

WeGIA < 3.5.0 - Open Redirect via control.php nextPage Parameter

CVSS 6.1

CVE-2025-54088 MEDIUM

Absolute Secure Access < 14.10 - Open Redirect via Console

CVSS 6.1

CVE-2025-11240 HIGH

KNIME Business Hub <1.16.0 - Open Redirect

CVSS 7.2

CVE-2025-61587 MEDIUM

Weblate < 5.13.3 - Open Redirect via Redir Parameter

CVSS 6.1

CVE-2025-57879 MEDIUM

Esri Portal for ArcGIS <= 11.4 - Unauthenticated Open Redirect

CVSS 6.1

CVE-2025-57878 MEDIUM

Esri Portal for ArcGIS <= 11.4 - Unauthenticated Open Redirect

CVSS 6.1

CVE-2025-57872 MEDIUM

Esri Portal for ArcGIS <= 11.4 - Unauthenticated Open Redirect

CVSS 6.1

CVE-2025-59426 MEDIUM

lobehub/lobe_chat < 1.130.1 - Open Redirect via X-Forwarded-Host Header

CVSS 4.3

CVE-2025-58006 MEDIUM

WP Gravity Forms Keap/Infusionsoft <1.2.4 - Open Redirect

CVSS 4.7

CVE-2025-7702 MEDIUM

Pusula Communication Information Internet Industry and Trade Ltd. C...

CVSS 4.7

CVE-2025-9084 LOW

Mattermost 10.5.0-10.5.9 - Open Redirect via OAuth Login URL

CVSS 3.1

CVE-2025-9072 HIGH

Mattermost <10.10.1-10.5.9-10.9.4 - Open Redirect

CVSS 7.6

CVE-2025-43795 MEDIUM

Liferay Portal 7.1.0-7.4.3.101 & DXP 2023.Q3.1-2023.Q3.4, 7.4 GA-92, 7.3 GA-35 Open Redirect

CVSS 6.1

CVE-2025-10229 MEDIUM

Freshwork <= 1.2.3 - Open Redirect via post_logout_redirect_uri Parameter

CVSS 4.3

CVE-2025-57665 MEDIUM

element-plus < 2.10.6 - Open Redirect and XSS via Link Component href Attribute

CVSS 6.4

CVE-2025-39523 MEDIUM

GoodBarber <= 1.0.26 - Open Redirect

CVSS 4.7

Details

Vulnerabilities 1,631

Exploit Likelihood Low

Links