Overview 149 matches · 11 in Waratek scope · 0 protected · 23 exploited · 0 CISA KEV · 10 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
11
7.4%
No exploit published
0
0.0%
Outside Waratek scope
1
0.7%
Not applicable
137
91.9%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
149
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
23
15.4%
Working exploit published
123
82.6%
Proof of concept only
3
2.0%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 22 / year
20052
Not applicable2
Medium2
not blocked2
Working exploit published2
20060
20070
20082
Not applicable2
Medium2
not blocked2
Exploited1
Working exploit published1
20090
20100
20110
20120
20130
20140
20151
Not applicable1
Medium1
not blocked1
Working exploit published1
20160
20179
Mitigation candidate1
Not applicable8
High1
Medium8
not blocked9
Working exploit published9
20189
Outside Waratek scope1
Not applicable8
Medium9
not blocked9
Working exploit published9
201915
Mitigation candidate2
Not applicable13
Medium15
not blocked15
Exploited3
Working exploit published12
202011
Mitigation candidate1
Not applicable10
Medium11
not blocked11
Exploited3
Working exploit published7
Proof of concept only1
202119
Not applicable19
Medium19
not blocked19
Exploited2
Working exploit published17
202222
Not applicable22
Critical1
High1
Medium20
not blocked22
Exploited4
Working exploit published18
202315
Mitigation candidate3
Not applicable12
High1
Medium14
not blocked15
Exploited2
Working exploit published12
Proof of concept only1
202417
Mitigation candidate2
Not applicable15
High2
Medium15
not blocked17
Exploited3
Working exploit published13
Proof of concept only1
202521
Mitigation candidate2
Not applicable19
Critical1
High3
Medium16
Low1
not blocked21
Exploited4
Working exploit published17
20266
Not applicable6
Medium6
not blocked6
Exploited1
Working exploit published5
20062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-55087 | Medium | 2026-08-19 | Not applicable | Working exploit published | Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad uses the attacker-controlled x-proxy-path request header in src/node/hooks/express/admin.ts when substituting paths into HTML, JavaScript, and CSS under /admin without sanitization, Vary: x-proxy-path, or Cache-Control: private, no-store. A shared proxy or CDN can cache the resulting response and serve attacker-injected script to an administrator. In src/node/hooks/express/specialpages.ts, version 3.0.0 also accepts a protocol-relative x-proxy-path value when constructing the /p/:pad/timeslider redirect, allowing redirection to an attacker-controlled host. The issues are exploitable when the deployment permits client-supplied x-proxy-path headers to reach Etherpad. This issue is fixed in version 3.1.0. |
| CVE-2026-6203 | Medium | 2026-04-13 | Not applicable | Working exploit published | The User Registration & Membership plugin for WordPress is vulnerable to Open Redirect in versions up to and including 5.1.4. This is due to insufficient validation of user-supplied URLs passed via the 'redirect_to_on_logout' GET parameter before redirecting users. The `redirect_to_on_logout` GET parameter is passed directly to WordPress's `wp_redirect()` function instead of the domain-restricted `wp_safe_redirect()`. While `esc_url_raw()` is applied to sanitize malformed URLs, it does not restrict the redirect destination to the local domain, allowing an attacker to craft a specially formed link that redirects users to potentially malicious external URLs after logout, which could be used to facilitate phishing attacks. |
| CVE-2026-34847 | Medium | 2026-04-02 | Not applicable | Working exploit published | hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, the /enter page contains a DOM-based open redirect vulnerability. The redirect query parameter is directly used to construct a URL and redirect the user without proper validation. This issue has been patched in version 2026.3.0. |
| CVE-2026-33868 | Medium | 2026-03-27 | Not applicable | Working exploit published | Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.8, 4.4.15, and 4.3.21, an unauthenticated Open Redirect vulnerability (CWE-601) exists in the `/web/*` route due to improper handling of URL-encoded path segments. An attacker can craft a specially encoded URL that causes the application to redirect users to an arbitrary external domain, enabling phishing attacks and potential OAuth credential theft. The issue occurs because URL-encoded slashes (`%2F`) bypass Rails path normalization and are interpreted as host-relative redirects. Versions 4.5.8, 4.4.15, and 4.3.21 patch the issue. |
| CVE-2026-1296 | Medium | 2026-02-18 | Not applicable | Working exploit published | The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection in all versions up to, and including, 1.2.7 due to insufficient validation on the 'requested_page' POST parameter in the verify_username_password function. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action such as clicking on a link. |
| CVE-2026-1277 | Medium | 2026-02-18 | Not applicable | Exploited | The URL Shortify plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.12.1 due to insufficient validation on the 'redirect_to' parameter in the promotional dismissal handler. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites via a crafted link. |
| CVE-2025-68602 | Medium | 2025-12-24 | Not applicable | Working exploit published | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Scott Paterson Accept Donations with PayPal & Stripe easy-paypal-donation allows Phishing.This issue affects Accept Donations with PayPal & Stripe: from n/a through <= 1.5.2. |
| CVE-2025-68509 | Medium | 2025-12-24 | Not applicable | Working exploit published | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Jeff Starr User Submitted Posts user-submitted-posts allows Phishing.This issue affects User Submitted Posts: from n/a through <= 20251121. |
| CVE-2025-58044 | Medium | 2025-12-01 | Not applicable | Working exploit published | JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses the Referer header as the redirection target without proper validation, which could lead to an Open Redirect vulnerability. This vulnerability is fixed in v3.10.19 and v4.10.5. |
| CVE-2025-54793 | Medium | 2025-08-08 | Not applicable | Working exploit published | Astro is a web framework for content-driven websites. In versions 5.2.0 through 5.12.7, there is an Open Redirect vulnerability in the trailing slash redirection logic when handling paths with double slashes. This allows an attacker to redirect users to arbitrary external domains by crafting URLs such as https://mydomain.com//malicious-site.com/. This increases the risk of phishing and other social engineering attacks. This affects sites that use on-demand rendering (SSR) with the Node or Cloudflare adapters. It does not affect static sites, or sites deployed to Netlify or Vercel. This issue is fixed in version 5.12.8. To work around this issue at the network level, block outgoing redirect responses with a Location header value that starts with `//`. |
| CVE-2025-50578 | Critical | 2025-07-30 | Not applicable | Working exploit published | LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, specifically `X-Forwarded-Host` and `Referer`. An unauthenticated remote attacker can manipulate these headers to perform Host Header Injection and Open Redirect attacks. This allows the loading of external resources from attacker-controlled domains and unintended redirection of users, potentially enabling phishing, UI redress, and session theft. The vulnerability exists due to insufficient validation and trust of untrusted input, affecting the integrity and trustworthiness of the application. |
| CVE-2025-6197 | Medium | 2025-07-18 | Not applicable | Working exploit published | An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation: - Multiple organizations must exist in the Grafana instance - Victim must be on a different organization than the one specified in the URL |
| CVE-2024-37656 | Medium | 2025-07-07 | Not applicable | Exploited | An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the insufficient URL parameter verification in bbs/logout.php. |
| CVE-2025-4123 | High | 2025-05-22 | Not applicable | Exploited | A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF. The default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive. |
| CVE-2025-40630 | Medium | 2025-05-16 | Not applicable | Working exploit published | Open redirection vulnerability in IceWarp Mail Server affecting version 11.4.0. This vulnerability allows an attacker to redirect a user to any domain by sending a malicious URL to the victim, for example “ https://icewarp.domain.com//<MALICIOUS_DOMAIN>/%2e%2e” https://icewarp.domain.com///%2e%2e” . This vulnerability has been tested in Firefox. |
| CVE-2024-6690 | Medium | 2025-05-15 | Not applicable | Exploited | The wccp-pro WordPress plugin before 15.3 contains an open-redirect flaw via the referrer parameter, allowing redirection of users to external sites |
| CVE-2023-6786 | Medium | 2025-05-15 | Not applicable | Working exploit published | The Payment Gateway for Telcell WordPress plugin through 2.0.1 does not validate the api_url parameter before redirecting the user to its value, leading to an Open Redirect issue |
| CVE-2025-32970 | Medium | 2025-04-30 | Mitigation candidate | Exploited | XWiki is a generic wiki platform. In versions starting from 13.5-rc-1 to before 15.10.13, from 16.0.0-rc-1 to before 16.4.4, and from 16.5.0-rc-1 to before 16.8.0, an open redirect vulnerability in the HTML conversion request filter allows attackers to construct URLs on an XWiki instance that redirects to any URL. This issue has been patched in versions 15.10.13, 16.4.4, and 16.8.0. |
| CVE-2025-27888 | Medium | 2025-03-20 | Mitigation candidate | Working exploit published | Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Druid. This issue affects all previous Druid versions. When using the Druid management proxy, a request that has a specially crafted URL could be used to redirect the request to an arbitrary server instead. This has the potential for XSS or XSRF. The user is required to be authenticated for this exploit. The management proxy is enabled in Druid's out-of-box configuration. It may be disabled to mitigate this vulnerability. If the management proxy is disabled, some web console features will not work properly, but core functionality is unaffected. Users are recommended to upgrade to Druid 31.0.2 or Druid 32.0.1, which fixes the issue. |
| CVE-2024-8021 | Medium | 2025-03-20 | Not applicable | Working exploit published | An open redirect vulnerability exists in the latest version of gradio-app/gradio. The vulnerability allows an attacker to redirect users to a malicious website by URL encoding. This can be exploited by sending a crafted request to the application, which results in a 302 redirect to an attacker-controlled site. |
| CVE-2024-11044 | Medium | 2025-03-20 | Not applicable | Working exploit published | An open redirect vulnerability in automatic1111/stable-diffusion-webui version 1.10.0 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This vulnerability can be exploited to conduct phishing attacks, distribute malware, and steal user credentials. |
| CVE-2024-10908 | Medium | 2025-03-20 | Not applicable | Working exploit published | An open redirect vulnerability in lm-sys/fastchat Release v0.2.36 allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This can be exploited for phishing attacks, malware distribution, and credential theft. |
| CVE-2024-10812 | Medium | 2025-03-20 | Not applicable | Working exploit published | An open redirect vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability occurs when a user is redirected to a URL specified by user-controlled input in the 'file' parameter without proper validation or sanitization. This can be exploited by attackers to conduct phishing attacks, distribute malware, and steal user credentials. |
| CVE-2024-13888 | High | 2025-02-20 | Not applicable | Working exploit published | The WPMobile.App plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 11.56. This is due to insufficient validation on the redirect URL supplied via the 'redirect' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action. |
| CVE-2025-25198 | High | 2025-02-12 | Not applicable | Working exploit published | mailcow: dockerized is an open source groupware/email suite based on docker. Prior to version 2025-01a, a vulnerability in mailcow's password reset functionality allows an attacker to manipulate the `Host HTTP` header to generate a password reset link pointing to an attacker-controlled domain. This can lead to account takeover if a user clicks the poisoned link. Version 2025-01a contains a patch. As a workaround, deactivate the password reset functionality by clearing `Notification email sender` and `Notification email subject` under System -> Configuration -> Options -> Password Settings. |
| CVE-2024-57241 | Medium | 2025-02-11 | Not applicable | Working exploit published | Dedecms 5.71sp1 and earlier is vulnerable to URL redirect. In the web application, a logic error does not judge the input GET request resulting in URL redirection. |
| CVE-2024-53995 | Low | 2025-01-08 | Not applicable | Working exploit published | SickChill is an automatic video library manager for TV shows. A user-controlled `login` endpoint's `next_` parameter takes arbitrary content. Prior to commit c7128a8946c3701df95c285810eb75b2de18bf82, an authenticated attacker may use this to redirect the user to arbitrary destinations, leading to open redirect. Commit c7128a8946c3701df95c285810eb75b2de18bf82 changes the login page to redirect to `settings.DEFAULT_PAGE` instead of to the `next` parameter. |
| CVE-2024-8883 | Medium | 2024-09-19 | Mitigation candidate | Exploited | A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking. |
| CVE-2024-35133 | High | 2024-08-29 | Not applicable | Working exploit published | IBM Security Verify Access 10.0.0 through 10.0.8 OIDC Provider could allow a remote authenticated attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim. |
| CVE-2024-41955 | Medium | 2024-07-31 | Not applicable | Working exploit published | Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redirect vulnerability exist in MobSF authentication view. Update to MobSF v4.0.5. |
| CVE-2024-6289 | Medium | 2024-07-15 | Not applicable | Working exploit published | The WPS Hide Login WordPress plugin before 1.9.16.4 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page. |
| CVE-2024-5936 | Medium | 2024-06-27 | Not applicable | Working exploit published | An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'file' parameter. This vulnerability allows attackers to redirect users to a URL specified by user-controlled input without proper validation or sanitization. The impact of this vulnerability includes potential phishing attacks, malware distribution, and credential theft. |
| CVE-2024-4940 | Medium | 2024-06-22 | Not applicable | Working exploit published | An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting (XSS), Server-Side Request Forgery (SSRF), amongst others. This issue is due to improper validation of user-supplied input in the handling of URLs. Attackers can exploit this vulnerability by crafting a malicious URL that, when processed by the application, redirects the user to an attacker-controlled web page. |
| CVE-2024-37881 | Medium | 2024-06-19 | Not applicable | Working exploit published | SiteGuard WP Plugin provides a functionality to customize the path to the login page wp-login.php and implements a measure to avoid redirection from other URLs. However, SiteGuard WP Plugin versions prior to 1.7.7 missed to implement a measure to avoid redirection from wp-register.php. As a result, the customized path to the login page may be exposed. |
| CVE-2024-3032 | Medium | 2024-06-13 | Not applicable | Working exploit published | Themify Builder WordPress plugin before 7.5.8 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue |
| CVE-2024-1183 | Medium | 2024-04-16 | Not applicable | Working exploit published | An SSRF (Server-Side Request Forgery) vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the presence of a 'Location' header or a 'File not allowed' error in the response. |
| CVE-2023-34020 | Medium | 2024-03-27 | Not applicable | Working exploit published | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash.This issue affects Uncanny Toolkit for LearnDash: from n/a through 3.6.4.3. |
| CVE-2024-0337 | Medium | 2024-03-20 | Not applicable | Working exploit published | The Travelpayouts: All Travel Brands in One Place WordPress plugin through 1.1.15 is vulnerable to Open Redirect due to insufficient validation on the travelpayouts_redirect variable. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action. |
| CVE-2024-22243 | High | 2024-02-23 | Not applicable | Proof of concept only | Applications that use UriComponentsBuilder to parse an externally provided URL (e.g. through a query parameter) AND perform validation checks on the host of the parsed URL may be vulnerable to a open redirect https://cwe.mitre.org/data/definitions/601.html attack or to a SSRF attack if the URL is used after passing validation checks. |
| CVE-2024-25608 | Medium | 2024-02-20 | Mitigation candidate | Exploited | HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 before update 4, 7.2 before fix pack 19, and older unsupported versions can be circumvented by using the 'REPLACEMENT CHARACTER' (U+FFFD), which allows remote attackers to redirect users to arbitrary external URLs via the (1) 'redirect` parameter (2) `FORWARD_URL` parameter, (3) `noSuchEntryRedirect` parameter, and (4) others parameters that rely on HtmlUtil.escapeRedirect. |
| CVE-2024-24763 | Medium | 2024-02-20 | Not applicable | Working exploit published | JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to version 3.10.0, attackers can exploit this vulnerability to construct malicious links, leading users to click on them, thereby facilitating phishing attacks or cross-site scripting attacks. Version 3.10.0 contains a patch for this issue. No known workarounds are available. |
| CVE-2024-0250 | Medium | 2024-02-12 | Not applicable | Exploited | The Analytics Insights for Google Analytics 4 (AIWP) WordPress plugin before 6.3 is vulnerable to Open Redirect due to insufficient validation on the redirect oauth2callback.php file. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action. |
| CVE-2023-6389 | Medium | 2024-01-29 | Not applicable | Working exploit published | The WordPress Toolbar WordPress plugin through 2.2.6 redirects to any URL via the "wptbto" parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action. |
| CVE-2024-21641 | Medium | 2024-01-05 | Not applicable | Working exploit published | Flarum is open source discussion platform software. Prior to version 1.8.5, the Flarum `/logout` route includes a redirect parameter that allows any third party to redirect users from a (trusted) domain of the Flarum installation to redirect to any link. For logged-in users, the logout must be confirmed. Guests are immediately redirected. This could be used by spammers to redirect to a web address using a trusted domain of a running Flarum installation. The vulnerability has been fixed and published as flarum/core v1.8.5. As a workaround, some extensions modifying the logout route can remedy this issue if their implementation is safe. |
| CVE-2023-49438 | Medium | 2023-12-26 | Not applicable | Working exploit published | An open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes. |
| CVE-2023-6380 | Medium | 2023-12-13 | Not applicable | Working exploit published | Open redirect vulnerability has been found in the Open CMS product affecting versions 14 and 15 of the 'Mercury' template. An attacker could create a specially crafted URL and send it to a specific user to redirect them to a malicious site and compromise them. Exploitation of this vulnerability is possible due to the fact that there is no proper sanitization of the 'URI' parameter. |
| CVE-2023-5375 | Medium | 2023-10-04 | Not applicable | Working exploit published | Open Redirect in GitHub repository mosparo/mosparo prior to 1.0.2. |
| CVE-2023-40779 | Medium | 2023-09-14 | Not applicable | Working exploit published | An issue in IceWarp Mail Server Deep Castle 2 v.13.0.1.2 allows a remote attacker to execute arbitrary code via a crafted request to the URL. |
| CVE-2023-41080 | Medium | 2023-08-25 | Mitigation candidate | Proof of concept only | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Tomcat.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.0.12, from 9.0.0-M1 through 9.0.79 and from 8.5.0 through 8.5.92. Older, EOL versions may also be affected. The vulnerability is limited to the ROOT (default) web application. |
| CVE-2021-36580 | Medium | 2023-07-27 | Not applicable | Exploited | Open Redirect vulnerability exists in IceWarp MailServer IceWarp Server Deep Castle 2 Update 1 (13.0.1.2) via the referer parameter. |
| CVE-2023-3139 | Medium | 2023-07-04 | Not applicable | Exploited | The Protect WP Admin WordPress plugin before 4.0 discloses the URL of the admin panel via a redirection of a crafted URL, bypassing the protection offered. |
| CVE-2023-33405 | Medium | 2023-06-21 | Not applicable | Working exploit published | Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect. |
| CVE-2023-32068 | Medium | 2023-05-15 | Mitigation candidate | Working exploit published | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions prior to 14.10.4 it's possible to exploit well known parameters in XWiki URLs to perform redirection to untrusted site. This vulnerability was partially fixed in the past for XWiki 12.10.7 and 13.3RC1 but there is still the possibility to force specific URLs to skip some checks, e.g. using URLs like `http:example.com` in the parameter would allow the redirect. The issue has now been patched against all patterns that are known for performing redirects. This issue has been patched in XWiki 14.10.4 and 15.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
| CVE-2023-29204 | Medium | 2023-04-15 | Mitigation candidate | Working exploit published | XWiki Commons are technical libraries common to several other top level XWiki projects. It is possible to bypass the existing security measures put in place to avoid open redirect by using a redirect such as `//mydomain.com` (i.e. omitting the `http:`). It was also possible to bypass it when using URL such as `http:/mydomain.com`. The problem has been patched on XWiki 13.10.10, 14.4.4 and 14.8RC1. |
| CVE-2023-24892 | High | 2023-03-14 | Not applicable | Working exploit published | Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability |
| CVE-2023-24735 | Medium | 2023-03-06 | Not applicable | Working exploit published | PMB v7.4.6 was discovered to contain an open redirect vulnerability via the component /opac_css/pmb.php. This vulnerability allows attackers to redirect victim users to an external domain via a crafted URL. |
| CVE-2023-22432 | Medium | 2023-03-06 | Not applicable | Working exploit published | Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary website by accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack. |
| CVE-2023-27292 | Medium | 2023-02-28 | Not applicable | Working exploit published | An open redirect vulnerability exposes OpenCATS to template injection due to improper validation of user-supplied GET parameters. |
| CVE-2022-28923 | Medium | 2023-02-06 | Not applicable | Working exploit published | Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs. |
| CVE-2022-45917 | Medium | 2022-12-07 | Not applicable | Working exploit published | ILIAS before 7.16 has an Open Redirect. |
| CVE-2022-40083 | Critical | 2022-09-28 | Not applicable | Working exploit published | Labstack Echo v4.8.0 was discovered to contain an open redirect vulnerability via the Static Handler component. This vulnerability can be leveraged by attackers to cause a Server-Side Request Forgery (SSRF). |
| CVE-2022-39258 | High | 2022-09-27 | Not applicable | Working exploit published | mailcow is a mailserver suite. A vulnerability innversions prior to 2022-09 allows an attacker to craft a custom Swagger API template to spoof Authorize links. This could redirect a victim to an attacker controller place to steal Swagger authorization credentials or create a phishing page to steal other information. The issue has been fixed with the 2022-09 mailcow Mootember Update. As a workaround, one may delete the Swapper API Documentation from their e-mail server. |
| CVE-2022-38131 | Medium | 2022-09-06 | Not applicable | Working exploit published | RStudio Connect prior to 2023.01.0 is affected by an Open Redirect issue. The vulnerability could allow an attacker to redirect users to malicious websites. |
| CVE-2022-29272 | Medium | 2022-06-29 | Not applicable | Exploited | In Nagios XI through 5.8.5, an open redirect vulnerability exists in the login function that could lead to spoofing. |
| CVE-2022-32444 | Medium | 2022-06-17 | Not applicable | Working exploit published | An issue was discovered in u5cms verion 8.3.5 There is a URL redirection vulnerability that can cause a user's browser to be redirected to another site via /loginsave.php. |
| CVE-2021-25111 | Medium | 2022-04-25 | Not applicable | Working exploit published | The English WordPress Admin WordPress plugin before 1.5.2 does not validate the admin_custom_language_return_url before redirecting users o it, leading to an open redirect issue |
| CVE-2022-1058 | Medium | 2022-03-24 | Not applicable | Working exploit published | Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5. |
| CVE-2022-0165 | Medium | 2022-03-14 | Not applicable | Working exploit published | The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the user to it via the kc_get_thumbn AJAX action available to both unauthenticated and authenticated users |
| CVE-2021-32478 | Medium | 2022-03-11 | Not applicable | Exploited | The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3, 3.9 to 3.9.6, 3.8 to 3.8.8 and earlier unsupported versions are affected. |
| CVE-2022-0869 | Medium | 2022-03-06 | Not applicable | Working exploit published | Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.12.3. |
| CVE-2021-46379 | Medium | 2022-03-04 | Not applicable | Exploited | DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through URL redirection to untrusted site. |
| CVE-2021-3654 | Medium | 2022-03-02 | Not applicable | Working exploit published | A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL. |
| CVE-2022-0692 | Medium | 2022-02-21 | Not applicable | Working exploit published | Open Redirect on Rudloff/alltube in Packagist rudloff/alltube prior to 3.0.1. |
| CVE-2022-0597 | Medium | 2022-02-15 | Not applicable | Working exploit published | Open Redirect in Packagist microweber/microweber prior to 1.2.11. |
| CVE-2021-25033 | Medium | 2022-02-14 | Not applicable | Exploited | The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given value, leading to an open redirect issue |
| CVE-2022-23102 | Medium | 2022-02-09 | Not applicable | Working exploit published | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V2.0). Affected products contain an open redirect vulnerability. An attacker could trick a valid authenticated user to the device into clicking a malicious link there by leading to phishing attacks. |
| CVE-2021-45328 | Medium | 2022-02-08 | Not applicable | Working exploit published | Gitea before 1.4.3 is affected by URL Redirection to Untrusted Site ('Open Redirect') via internal URLs. |
| CVE-2021-25074 | Medium | 2022-01-24 | Not applicable | Working exploit published | The WebP Converter for Media WordPress plugin before 4.0.3 contains a file (passthru.php) which does not validate the src parameter before redirecting the user to it, leading to an Open Redirect issue |
| CVE-2021-25028 | Medium | 2022-01-24 | Not applicable | Working exploit published | The Event Tickets WordPress plugin before 5.2.2 does not validate the tribe_tickets_redirect_to parameter before redirecting the user to the given value, leading to an arbitrary redirect issue |
| CVE-2021-24838 | Medium | 2022-01-17 | Not applicable | Working exploit published | The AnyComment WordPress plugin before 0.3.5 has an API endpoint which passes user input via the redirect parameter to the wp_redirect() function without being validated first, leading to an Open Redirect issue, which according to the vendor, is a feature. |
| CVE-2021-44528 | Medium | 2022-01-10 | Not applicable | Working exploit published | A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. |
| CVE-2021-20031 | Medium | 2021-10-12 | Not applicable | Working exploit published | A Host Header Redirection vulnerability in SonicOS potentially allows a remote attacker to redirect firewall management users to arbitrary web domains. |
| CVE-2021-41826 | Medium | 2021-09-30 | Not applicable | Exploited | PlaceOS Authentication Service before 1.29.10.0 allows app/controllers/auth/sessions_controller.rb open redirect. |
| CVE-2021-39501 | Medium | 2021-09-07 | Not applicable | Working exploit published | EyouCMS 1.5.4 is vulnerable to Open Redirect. An attacker can redirect a user to a malicious url via the Logout function. |
| CVE-2021-24406 | Medium | 2021-07-06 | Not applicable | Working exploit published | The wpForo Forum WordPress plugin before 1.9.7 did not validate the redirect_to parameter in the login form of the forum, leading to an open redirect issue after a successful login. Such issue could allow an attacker to induce a user to use a login URL redirecting to a website under their control and being a replica of the legitimate one, asking them to re-enter their credentials (which will then in the attacker hands) |
| CVE-2021-24358 | Medium | 2021-06-14 | Not applicable | Working exploit published | The Plus Addons for Elementor Page Builder WordPress plugin before 4.1.10 did not validate a redirect parameter on a specifically crafted URL before redirecting the user to it, leading to an Open Redirect issue. |
| CVE-2020-18268 | Medium | 2021-06-07 | Not applicable | Working exploit published | Open Redirect in Z-BlogPHP v1.5.2 and earlier allows remote attackers to obtain sensitive information via the "redirect" parameter in the component "zb_system/cmd.php." |
| CVE-2021-29622 | Medium | 2021-05-19 | Not applicable | Working exploit published | Prometheus is an open-source monitoring system and time series database. In 2.23.0, Prometheus changed its default UI to the New ui. To ensure a seamless transition, the URL's prefixed by /new redirect to /. Due to a bug in the code, it is possible for an attacker to craft an URL that can redirect to any other URL, in the /new endpoint. If a user visits a prometheus server with a specially crafted address, they can be redirected to an arbitrary URL. The issue was patched in the 2.26.1 and 2.27.1 releases. In 2.28.0, the /new endpoint will be removed completely. The workaround is to disable access to /new via a reverse proxy in front of Prometheus. |
| CVE-2020-36365 | Medium | 2021-05-19 | Not applicable | Working exploit published | Smartstore (aka SmartStoreNET) before 4.1.0 allows CommonController.ClearCache, ClearDatabaseCache, RestartApplication, and ScheduleTaskController.Edit open redirect. |
| CVE-2021-32618 | Medium | 2021-05-17 | Not applicable | Working exploit published | The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is an independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. All versions of Flask-Security-Too allow redirects after many successful views (e.g. /login) by honoring the ?next query param. There is code in FS to validate that the url specified in the next parameter is either relative OR has the same netloc (network location) as the requesting URL. This check utilizes Pythons urlsplit library. However many browsers are very lenient on the kind of URL they accept and 'fill in the blanks' when presented with a possibly incomplete URL. As a concrete example - setting http://login?next=\\\github.com will pass FS's relative URL check however many browsers will gladly convert this to http://github.com. Thus an attacker could send such a link to an unwitting user, using a legitimate site and have it redirect to whatever site they want. This is considered a low severity due to the fact that if Werkzeug is used (which is very common with Flask applications) as the WSGI layer, it by default ALWAYS ensures that the Location header is absolute - thus making this attack vector mute. It is possible for application writers to modify this default behavior by setting the 'autocorrect_location_header=False`. |
| CVE-2021-24288 | Medium | 2021-05-17 | Not applicable | Working exploit published | When subscribing using AcyMailing, the 'redirect' parameter isn't properly sanitized. Turning the request from POST to GET, an attacker can craft a link containing a potentially malicious landing page and send it to the victim. |
| CVE-2020-23015 | Medium | 2021-05-03 | Not applicable | Working exploit published | An open redirect issue was discovered in OPNsense through 20.1.5. The redirect parameter "url" in login page was not filtered and can redirect user to any website. |
| CVE-2020-21998 | Medium | 2021-04-27 | Not applicable | Working exploit published | In HomeAutomation 3.3.2 input passed via the 'redirect' GET parameter in 'api.php' script is not properly verified before being used to redirect users. This can be exploited to redirect a user to an arbitrary website e.g. when a user clicks a specially crafted link to the affected script hosted on a trusted domain. |
| CVE-2021-24210 | Medium | 2021-04-05 | Not applicable | Working exploit published | There is an open redirect in the PhastPress WordPress plugin before 1.111 that allows an attacker to malform a request to a page with the plugin and then redirect the victim to a malicious page. There is also a support comment from another user one year ago (https://wordpress.org/support/topic/phast-php-used-for-remote-fetch/) that says that the php involved in the request only go to whitelisted pages but it's possible to redirect the victim to any domain. |
| CVE-2021-24165 | Medium | 2021-04-05 | Not applicable | Working exploit published | In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect parameter and no protection in place. |
| CVE-2020-24550 | Medium | 2021-03-31 | Not applicable | Working exploit published | An Open Redirect vulnerability in EpiServer Find before 13.2.7 allows an attacker to redirect users to untrusted websites via the _t_redirect parameter in a crafted URL, such as a /find_v2/_click URL. |
| CVE-2021-21337 | Medium | 2021-03-08 | Not applicable | Working exploit published | Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an open redirect vulnerability. A maliciously crafted link to the login form and login functionality could redirect the browser to a different website. The problem has been fixed in version 2.6.1. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to `2.6.1` and re-run the buildout, or if you used `pip` simply do `pip install "Products.PluggableAuthService>=2.6.1". |
| CVE-2021-22881 | Medium | 2021-02-11 | Not applicable | Working exploit published | The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website. |
| CVE-2020-22840 | Medium | 2021-02-09 | Not applicable | Working exploit published | Open redirect vulnerability in b2evolution CMS version prior to 6.11.6 allows an attacker to perform malicious open redirects to an attacker controlled resource via redirect_to parameter in email_passthrough.php. |
| CVE-2021-22873 | Medium | 2021-01-26 | Not applicable | Exploited | Revive Adserver before 5.1.0 is vulnerable to open redirects via the `dest`, `oadest`, and/or `ct0` parameters of the lg.php and ck.php delivery scripts. Such open redirects had previously been available by design to allow third party ad servers to track such metrics when delivering ads. However, third party click tracking via redirects is not a viable option anymore, leading to such open redirect functionality being removed and reclassified as a vulnerability. |