CVE Catalog
CVE-2026-35474
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk0.18%
8th percentile - higher than 8% of all known CVEs
Summary
WeGIA before version 3.6.9 contains an open redirect vulnerability. The 'redirect' parameter is taken directly from $_GET without URL validation and used in a Location header, allowing redirection to arbitrary external sites.
Risk Assessment
Attackers can abuse the trusted WeGIA domain for phishing, credential theft, or malware distribution.
Recommendation
Update WeGIA to version 3.6.9 or later.
Original NVD description (English source)
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, open redirect has been found in WeGIA webapp. The redirect parameter is taken directly from $_GET with no URL validation or whitelist check, then used verbatim in a header("Location: ...") call. This vulnerability is fixed in 3.6.9.