CVE-2026-35396
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
WeGIA before version 3.6.9 contains an open redirect vulnerability in the /WeGIA/controle/control.php endpoint via the nextPage parameter when combined with metodo=listarId and nomeClasse=IsaidaControle. The parameter is not validated, allowing redirection to arbitrary external websites.
Risk Assessment
Attackers can abuse the trusted WeGIA domain for phishing, credential theft, malware distribution, and social engineering.
Recommendation
Immediately update WeGIA to version 3.6.9, where the vulnerability is fixed.
Original NVD description (English source)
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarId and nomeClasse=IsaidaControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain. This vulnerability is fixed in 3.6.9.