5356 matches found
PlaceOS 1.2109.1 - Open Redirection
PlaceOS Authentication Service before 1.29.10.0 allows app/controllers/auth/sessionscontroller.rb open redirect. id: CVE-2021-41826 info: name: PlaceOS 1.2109.1 - Open Redirection author: geeknik severity: medium description: PlaceOS Authentication Service before 1.29.10.0 allows...
EpiServer Find <13.2.7 - Open Redirect
EpiServer Find before 13.2.7 contains an open redirect vulnerability via the tredirect parameter in a crafted URL, such as a /findv2/click URL. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id:...
BDU-2023-05144
BDU:2023-05144 BDU:2023-05144 Nuclei checker Netcat CMS 6.2.0.23239 Open redirect CWE-601...
CVE-2026-47883
CVE-2026-47883: Spring Framework UrlHandlerFilter Open Redirect PoC This repository is a minimal reproduction PoC for CVE-2026-47883, published as an official Spring security advisory. Official advisory: https://spring.io/security/cve-2026-47883/ Official title: Spring Framework Open Redirect in...
Frappe Google OAuth state is client-controllable, enabling redirects and authorization-flow abuse
Frappe Google OAuth State Is Client-Controllable, Enabling Redirects and Authorization-Flow Abuse Vulnerability Overview The Google integrations in Frappe Framework Gmail/Calendar/Drive, etc. share a unified OAuth authorization entry point and callback handler. Before the fix, the authorization...
Frappe Connected App OAuth flow: insufficient permission checks and external redirect
Frappe Connected App OAuth Flow: Insufficient Permission Checks and External Redirect Vulnerability Overview Connected App in Frappe Framework is an OAuth2 client integration mechanism; its whitelisted method is used to generate an authorization URL for a user and write the authorization state in...
GHSA-FJGC-3MJ7-8RG8 ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header
GHSA-03 — x-proxy-path header reflected into admin HTML/JS/CSS cache-poisoning XSS and concatenated into redirect open-redirect Severity: Medium CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS suggested base score: 6.1 — Medium Re-validate in the first.gov calculator before...
ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header
GHSA-03 — x-proxy-path header reflected into admin HTML/JS/CSS cache-poisoning XSS and concatenated into redirect open-redirect Severity: Medium CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS suggested base score: 6.1 — Medium Re-validate in the first.gov calculator before...
PT-2026-75963
GHSA-03 — x-proxy-path header reflected into admin HTML/JS/CSS cache-poisoning XSS and concatenated into redirect open-redirect Severity: Medium CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS suggested base score: 6.1 — Medium Re-validate in the first.gov calculator before...
PT-2026-76573
Name of the Vulnerable Software and Affected Versions Etherpad versions 2.1.0 through 3.0.0 Description Etherpad fails to properly sanitize the x-proxy-path request header, leading to two distinct issues when client-supplied headers reach the server. First, in src/node/hooks/express/admin.ts, the...
Security Bulletin:Vulnerability in Spring MVC and WebFlux affects IBM Netezza Appliance
Summary The Spring MVC and WebFlux package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVE CVE-2026-41844 Vulnerability Details CVEID:CVE-2026-41844 DESCRIPTION: A Spring MVC or Spring WebFlux application which configures a mapping for "/" where the view...
Security Bulletin: Vulnerability in go-chi/chi bundled with IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging.
Summary IBM Fusion, IBM Fusion HCI, and IBM Fusion Data Cataloging include the go-chi/chi library, which is affected by a denial of service vulnerability. CVE-2025-69725. Vulnerability Details CVEID:CVE-2025-69725 DESCRIPTION: An Open Redirect vulnerability in the go-chi/chi =5.2.2 RedirectSlashe...
CVE-2026-50089 Aqara IAM/SSO Gateway open redirect
The Aqara IAM/SSO Gateway gw-builder.aqara.com provides an open redirect, which is an instance of "CWE-601: URL Redirection to Untrusted Site," with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N 6.1 Medium, which can be used to set up a phishing attack...
EUVD-2026-22313
An URL Redirection to Untrusted Site 'Open Redirect' vulnerability CWE-601 vulnerability in Fortinet FortiNAC-F 7.6.0 through 7.6.5, FortiNAC-F 7.4 all versions, FortiNAC-F 7.2 all versions may allow a remote privileged attacker with system administrator role to redirect users to an arbitrary...
CVE-2026-21741: URL Redirection to Untrusted Site
An URL Redirection to Untrusted Site 'Open Redirect' vulnerability CWE-601 vulnerability in Fortinet FortiNAC-F 7.6.0 through 7.6.5, FortiNAC-F 7.4 all versions, FortiNAC-F 7.2 all versions may allow a remote privileged attacker with system administrator role to redirect users to an arbitrary...
EUVD-2025-208451
An issue pertaining to CWE-601: URL Redirection to Untrusted Site was discovered in Sunbird-Ed SunbirdEd-portal v1.13.4...
CVE-2025-70037: URL Redirection to Untrusted Site
An issue pertaining to CWE-601: URL Redirection to Untrusted Site was discovered in linagora Twake v2023.Q1.1223. This allows attackers to obtain sensitive information and execute arbitrary code...
CVE-2022-31735
OpenAM Consortium Edition version 14.0.0 provided by OpenAM Consortium contains an open redirect vulnerability CWE-601. When accessing an affected server through some specially crafted URL, the user may be redirected to an arbitrary website...
CVE-2025-54196 Adobe Connect | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601)
Adobe Connect versions 12.9 and earlier are affected by a URL Redirection to Untrusted Site 'Open Redirect' vulnerability. An attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction in that a victim must click on a...