Open Redirect Vulnerability in WeGIA Web Manager for Charitable Institutions

CVE-2026-35398

What is CVE-2026-35398?

The WeGIA Web Manager, designed for charitable institutions, has an Open Redirect vulnerability in its control.php endpoint affecting versions prior to 3.6.9. This flaw arises from inadequate validation of the nextPage parameter, particularly when used with certain request methods. Attackers can exploit this by redirecting users to malicious external sites, facilitating phishing campaigns, credential theft, malware infections, and social engineering attacks while maintaining the trust associated with the WeGIA domain. The issue has been rectified in version 3.6.9.

References