An open redirect flaw exists in the /WeGIA/controle/control.php endpoint when the nextPage parameter is used together with metodo=listarTodos and nomeClasse=TipoEntradaControle. The application accepts any value for nextPage without validation, causing the browser to navigate to an arbitrary external URL. This mechanism can be abused for phishing, credential theft, malware delivery, or other social‑engineering attacks that rely on the trusted appearance of the WeGIA domain.

The WeGIA web manager provided by LabRedesCefetRJ is impacted in all releases prior to 3.6.2. Users who have not applied the 3.6.2 update retain the vulnerability.

The CVSS score of 4.8 indicates moderate severity, while the EPSS value of less than 1% reflects a presently low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The most likely attack path involves an attacker crafting a malicious link that redirects a user through the vulnerable endpoint; any user who follows that link can be affected, so the threat is primarily user‑oriented and relies on social engineering.