Open Redirect Vulnerability in WeGIA Web Manager for Charitable Institutions

CVE-2026-35472

What is CVE-2026-35472?

The WeGIA application, designed for charitable institutions, is susceptible to an Open Redirect vulnerability located in the /WeGIA/controle/control.php endpoint. This occurs through the manipulation of the nextPage parameter when combined with metodo=listarTodos and nomeClasse=EstoqueControle. The application fails to properly validate or restrict this parameter, enabling attackers to redirect users to untrusted external sites. This lapse in security can be exploited for various malicious activities, such as phishing scams, credential theft, malware distribution, or other forms of social engineering that leverage the WeGIA domain's trustworthiness. This issue has been addressed in version 3.6.9.

References