Vulnerabilities > URL Redirection to Untrusted Site ('Open Redirect')
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2025-05-30 | CVE-2025-48936 | Open Redirect vulnerability in Zitadel Zitadel is open-source identity infrastructure software. | 8.8 |
| 2025-05-26 | CVE-2025-5183 | Open Redirect vulnerability in Summerpearlgroup Vacation Rental Management Platform A vulnerability was found in Summer Pearl Group Vacation Rental Management Platform up to 1.0.1 and classified as problematic. | 4.7 |
| 2025-05-21 | CVE-2024-12561 | The Affiliate Sales in Google Analytics and other tools plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.4.9. | 6.1 |
| 2025-05-20 | CVE-2025-47854 | Open Redirect vulnerability in Jetbrains Teamcity In JetBrains TeamCity before 2025.03.2 open redirect was possible on editing VCS Root page | 6.1 |
| 2025-05-13 | CVE-2025-30010 | The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an unauthenticated attacker to craft a malicious link, which when clicked by a victim, redirects the browser to a malicious site. | 6.1 |
| 2025-05-01 | CVE-2025-4143 | Open Redirect vulnerability in Cloudflare Workers-Oauth-Provider 0.0.5 The OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp , did not correctly validate that redirect_uri was on the allowed list of redirect URIs for the given client registration. Fixed in: https://github.com/cloudflare/workers-oauth-provider/pull/26 https://github.com/cloudflare/workers-oauth-provider/pull/26 Impact: Under certain circumstances (see below), if a victim had previously authorized with a server built on workers-oath-provider, and an attacker could later trick the victim into visiting a malicious web site, then attacker could potentially steal the victim's credentials to the same OAuth server and subsequently impersonate them. In order for the attack to be possible, the OAuth server's authorized callback must be designed to auto-approve authorizations that appear to come from an OAuth client that the victim has authorized previously. | 6.1 |
| 2025-04-30 | CVE-2025-3859 | Open Redirect vulnerability in Mozilla Firefox Focus Websites directing users to long URLs that caused eliding to occur in the location view could leverage the truncating behavior to potentially trick users into thinking they were on a different webpage This vulnerability affects Focus < 138. | 6.1 |
| 2025-04-20 | CVE-2020-36845 | Open Redirect vulnerability in Knowbe4 Security Awareness Training The KnowBe4 Security Awareness Training application before 2020-01-10 contains a redirect function that does not validate the destination URL before redirecting. | 6.1 |
| 2025-04-08 | CVE-2025-3433 | The Advanced Advertising System plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.3.1. | 6.1 |
| 2025-02-25 | CVE-2024-11955 | Open Redirect vulnerability in Glpi-Project Glpi A vulnerability was found in GLPI up to 10.0.17. | 6.1 |