Filtered by CWE-601
Filtered by vendor Subscriptions
Total 1404 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-25657 1 Avsystem 1 Unified Management Platform 2025-07-13 5.4 Medium
An open redirect in the Login/Logout functionality of web management in AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS could allow attackers to redirect authenticated users to malicious websites.
CVE-2024-32078 2 Foliovision, Wordpress 2 Fv Flowplayer Video Player, Wordpress 2025-07-13 4.1 Medium
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Foliovision FV Flowplayer Video Player.This issue affects FV Flowplayer Video Player: from n/a through 7.5.44.7212.
CVE-2024-9266 1 Expressjs 1 Express 2025-07-13 4.7 Medium
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express. This vulnerability affects the use of the Express Response object. This issue impacts Express: from 3.4.5 before 4.0.0.
CVE-2025-6552 1 Java-aodeng 1 Hope-boot 2025-07-12 4.3 Medium
A vulnerability was found in java-aodeng Hope-Boot 1.0.0. It has been classified as problematic. Affected is the function doLogin of the file /src/main/java/com/hope/controller/WebController.java of the component Login. The manipulation of the argument redirect_url leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-24740 2 Thimpress, Wordpress 2 Learnpress, Wordpress 2025-07-12 4.7 Medium
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ThimPress LearnPress. This issue affects LearnPress: from n/a through 4.2.7.1.
CVE-2024-9387 1 Gitlab 1 Gitlab 2025-07-11 6.4 Medium
An issue was discovered in GitLab CE/EE affecting all versions from 11.8 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. An attacker could potentially perform an open redirect against a given releases API endpoint.
CVE-2024-11274 1 Gitlab 1 Gitlab 2025-07-11 8.7 High
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, injection of NEL headers in k8s proxy response could lead to session data exfiltration.
CVE-2024-22854 1 Darktrace 1 Threat Visualizer 2025-07-11 6.1 Medium
DOM-based HTML injection vulnerability in the main page of Darktrace Threat Visualizer version 6.1.27 (bundle version 61050) and before has been identified. A URL, crafted by a remote attacker and visited by an authenticated user, allows open redirect and potential credential stealing using an injected HTML form.
CVE-2024-37656 1 Sir 1 Gnuboard 2025-07-11 6.1 Medium
An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the insufficient URL parameter verification in bbs/logout.php.
CVE-2024-37657 1 Sir 1 Gnuboard 2025-07-11 6.1 Medium
An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via thebbs/login.php component.
CVE-2024-37658 1 Sir 1 Gnuboard 2025-07-11 6.1 Medium
An open redirect vulnerability in gnuboard5 v.5.5.16 allows a remote attacker to obtain sensitive information via the bbs/member_confirm.php.
CVE-2024-38211 1 Microsoft 1 Dynamics 365 2025-07-10 8.2 High
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2025-6701 1 Xuxueli 1 Xxl-sso 2025-07-10 3.5 Low
A vulnerability, which was classified as problematic, has been found in Xuxueli xxl-sso 1.1.0. This issue affects some unknown processing of the file /xxl-sso-server/doLogin. The manipulation of the argument redirect_url leads to open redirect. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-42981 2025-07-08 6.1 Medium
Due to an open redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft a URL link embedding a malicious script at a location not properly sanitized. When a victim clicks on this link, the script executes within the victim's browser, redirecting them to a site controlled by the attacker. This allows the attacker to access and/or modify restricted information related to the web client. While the vulnerability poses no impact on data availability, it presents a considerable risk to confidentiality and integrity.
CVE-2025-42985 2025-07-08 6.1 Medium
Due to insufficient sanitization in the SAP BusinessObjects Content Administrator Workbench, attackers could craft malicious URLs and execute scripts in a victim�s browser. This could potentially lead to the exposure or modification of web client data, resulting in low impact on confidentiality and integrity, with no impact on application availability.
CVE-2024-43536 1 Microsoft 9 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 6 more 2025-07-08 6.8 Medium
Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-43543 1 Microsoft 9 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 6 more 2025-07-08 6.8 Medium
Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-54957 1 Nagios 1 Nagios Xi 2025-07-07 6.1 Medium
Nagios XI 2024R1.2.2 is vulnerable to an open redirect flaw on the Tools page, exploitable by users with read-only permissions. This vulnerability allows an attacker to craft a malicious link that redirects users to an arbitrary external URL without their consent.
CVE-2024-24818 1 Espocrm 1 Espocrm 2025-06-27 5.9 Medium
EspoCRM is an Open Source Customer Relationship Management software. An attacker can inject arbitrary IP or domain in "Password Change" page and redirect victim to malicious page that could lead to credential stealing or another attack. This vulnerability is fixed in 8.1.2.
CVE-2025-6286 1 Phpgurukul 1 Covid19 Testing Management System 2025-06-27 3.5 Low
A vulnerability classified as problematic has been found in PHPGurukul COVID19 Testing Management System 2021. Affected is an unknown function of the file /search-report-result.php. The manipulation of the argument q leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.