CVE-2021-3647

URI.js is vulnerable to URL Redirection to Untrusted Site

• CWE-601
• CWE-601

• https://github.com/medialize/URI.js/commit/ac43ca8f80c042f0256fb551ea5203863dec4481Patch, Third Party Advisory
• https://huntr.dev/bounties/1625558772840-medialize/URI.jsExploit, Issue Tracking, Third Party Advisory
• https://github.com/medialize/URI.js/commit/ac43ca8f80c042f0256fb551ea5203863dec4481Patch, Third Party Advisory
• https://huntr.dev/bounties/1625558772840-medialize/URI.jsExploit, Issue Tracking, Third Party Advisory

Published

Jul 16, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-36450Verint Workforce Optimization (WFO) 15.2.8.10048 allows XSS …6.1
• CVE-2021-36454Cross Site Scripting (XSS) vulnerability in Naviwebs Navigat…5.4
• CVE-2021-36455SQL Injection vulnerability in Naviwebs Navigate CMS 2.9 via…8.8
• CVE-2021-3646btcpayserver is vulnerable to Improper Neutralization of Inp…6.1
• CVE-2021-36460VeryFitPro (com.veryfit2hr.second) 3.2.8 hashes the account'…7.8
• CVE-2021-36461An Arbitrary File Upload vulnerability exists in Microweber …8.8
• CVE-2021-36471Directory Traversal vulnerability in AdminLTE 3.1.0 allows r…9.8
• CVE-2021-3648Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-36483DevExpress.XtraReports.UI through v21.1 allows attackers to …8.8
• CVE-2021-36484SQL injection vulnerability in JIZHICMS 1.9.5 allows attacke…9.8
• CVE-2021-36489Buffer Overflow vulnerability in Allegro through 5.2.6 allow…6.5
• CVE-2021-3649chatwoot is vulnerable to Inefficient Regular Expression Com…7.5