CVE-2024-4940

An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting (XSS), Server-Side Request Forgery (SSRF), amongst others. This issue is due to improper validation of user-supplied input in the handling of URLs. Attackers can exploit this vulnerability by crafting a malicious URL that, when processed by the application, redirects the user to an attacker-controlled web page.

• CWE-601

• https://huntr.com/bounties/35aaea93-6895-4f03-9c1b-cd992665aa60Exploit, Third Party Advisory
• https://huntr.com/bounties/35aaea93-6895-4f03-9c1b-cd992665aa60Exploit, Third Party Advisory

Published

Jun 22, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-49394In mutt and neomutt the In-Reply-To email header field is no…5.3
• CVE-2024-49395In mutt and neomutt, PGP encryption does not use the --hidde…5.3
• CVE-2024-49396The affected product is vulnerable due to insufficiently pro…8.7
• CVE-2024-49397The affected product is vulnerable to a cross-site scripting…9.2
• CVE-2024-49398The affected product is vulnerable to unrestricted file uplo…8.8
• CVE-2024-49399The affected product is vulnerable to an attacker being able…8.7
• CVE-2024-49400Tacquito prior to commit 07b49d1358e6ec0b5aa482fcd284f509191…9.8
• CVE-2024-49401Improper input validation in Settings Suggestions prior to S…7.1
• CVE-2024-49402Improper input validation in Dressroom prior to SMR Nov-2024…4.6
• CVE-2024-49403Improper access control in Samsung Voice Recorder prior to v…4.6
• CVE-2024-49404Improper Access Control in Samsung Video Player prior to ver…4.6
• CVE-2024-49405Improper authentication in Private Info in Samsung Pass in p…4.6