← Back
CWE-601

1,689 CVEs • Abstraction: Base • Likelihood of Exploit: Low

URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

JSON object

Loading...

CVEs (1,689)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2012-0518
1Oracle
1Fusion Middleware
Apr 22, 2026
Oct 16, 2012
N/A· v4
4.7 MEDIUM· v3
4.3 MEDIUM· v2
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to Redirects, a different...Show more
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3.0 allows remote attackers to affect integrity via unknown vectors related to Redirects, a different vulnerability than CVE-2012-3175.Show less
CVE-2009-3832
1Opera
1Opera Browser
Apr 23, 2026
Oct 30, 2009
N/A· v4
N/A· v3
5.8 MEDIUM· v2
Opera before 10.01 on Windows does not prevent use of Web fonts in rendering the product's own user interface, which allows remote attackers to spoof the address field via a crafted web site.
CVE-2008-1547
1Microsoft
1Exchange Server
Apr 23, 2026
Oct 21, 2008
N/A· v4
N/A· v3
4.3 MEDIUM· v2
Open redirect vulnerability in exchweb/bin/redir.asp in Microsoft Outlook Web Access (OWA) for Exchange Server 2003 SP2 (aka build 6.5.7638) allows remote attackers to redirect users to arbitrary web sites and conduct ph...Show more
Open redirect vulnerability in exchweb/bin/redir.asp in Microsoft Outlook Web Access (OWA) for Exchange Server 2003 SP2 (aka build 6.5.7638) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the URL parameter.Show less
CVE-2008-2951
2Edgewall
Fedoraproject
2Fedora
Trac
Apr 23, 2026
Jul 27, 2008
N/A· v4
6.1 MEDIUM· v3
5.8 MEDIUM· v2
Open redirect vulnerability in the search script in Trac before 0.10.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter, possibly related to the q...Show more
Open redirect vulnerability in the search script in Trac before 0.10.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter, possibly related to the quickjump function.Show less
CVE-2008-2052
1Bitrix24
1Bitrix Site Manager
Apr 23, 2026
May 2, 2008
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
Open redirect vulnerability in redirect.php in Bitrix Site Manager 6.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the goto parameter.
CVE-2005-4206
1Blackboard
1Academic Suite
Apr 16, 2026
Dec 13, 2005
N/A· v4
6.1 MEDIUM· v3
4.0 MEDIUM· v2
Blackboard Learning and Community Portal System in Academic Suite 6.3.1.424, 6.2.3.23, and other versions before 6 allows remote attackers to redirect users to other URLs and conduct phishing attacks via a modified url p...Show more
Blackboard Learning and Community Portal System in Academic Suite 6.3.1.424, 6.2.3.23, and other versions before 6 allows remote attackers to redirect users to other URLs and conduct phishing attacks via a modified url parameter to frameset.jsp, which loads the URL into a frame and causes it to appear to be part of a valid page.Show less
CVE-2005-1475
1Opera
1Opera Browser
Apr 16, 2026
Jun 16, 2005
N/A· v4
N/A· v3
7.5 HIGH· v2
The XMLHttpRequest object in Opera 8.0 Final Build 1095 allows remote attackers to bypass access restrictions and perform unauthorized actions on other domains via a redirect.
CVE-2005-0420
1Microsoft
1Exchange Server
Apr 16, 2026
Apr 27, 2005
N/A· v4
N/A· v3
5.8 MEDIUM· v2
Microsoft Outlook Web Access (OWA), when used with Exchange, allows remote attackers to redirect users to arbitrary URLs for login via a link to the owalogon.asp application.
CVE-2004-2260
1Opera
1Opera Browser
Apr 16, 2026
Dec 31, 2004
N/A· v4
N/A· v3
5.0 MEDIUM· v2
Opera Browser 7.23, and other versions before 7.50, updates the address bar as soon as the user clicks a link, which allows remote attackers to redirect to other sites via the onUnload attribute.