CVE-2026-35398
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
WeGIA prior to 3.6.9 has an Open Redirect vulnerability in the /WeGIA/controle/control.php endpoint via the nextPage parameter. The application fails to validate the parameter, allowing redirection to arbitrary external sites.
Risk Assessment
Attackers can abuse the trusted WeGIA domain for phishing, credential theft, malware distribution, or social engineering.
Recommendation
Update WeGIA to version 3.6.9 or later, which includes a fix that validates the nextPage parameter.
Original NVD description (English source)
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarTodos & listarId_Nome and nomeClasse=OrigemControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain. This vulnerability is fixed in 3.6.9.