CVE-2026-35473
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
WeGIA before version 3.6.9 has an open redirect vulnerability in the /WeGIA/controle/control.php endpoint via the 'nextPage' parameter. The application fails to validate this parameter, allowing attackers to redirect users to arbitrary external sites.
Risk Assessment
Similar to CVE-2026-35474, attackers can abuse the trusted WeGIA domain for phishing, credential theft, or malware distribution.
Recommendation
Update WeGIA to version 3.6.9 or later.
Original NVD description (English source)
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarId and nomeClasse=IentradaControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain. This vulnerability is fixed in 3.6.9.