This vulnerability allows an attacker to craft a request to the control.php endpoint with the nextPage parameter set to an arbitrary URL when the method and class parameters are set to specific values. The application does not validate or restrict this parameter, so a user who follows the link will be redirected to an external domain controlled by the attacker. This can be abused to trick users into entering their credentials on a fake login page or to download malware. The exploit does not require local system access or privileged credentials; it relies only on manipulating a normal HTTP request.

The affected product is the WeGIA web manager for charitable institutions, produced by LabRedesCefetRJ. Versions earlier than 3.6.2 are vulnerable, as the fix that validates the nextPage parameter was delivered in release 3.6.2.

The CVSS score is 4.8, indicating moderate severity. The EPSS score is below 1%, implying a low probability of exploitation at the time of analysis, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be a remote HTTP request to the control.php endpoint, requiring no special environment; the attacker can leverage the trusted WeGIA domain to conduct phishing campaigns.