WeGIA, a web manager for charitable institutions, contains an open redirect flaw in its control.php endpoint. By omitting validation on the nextPage query parameter when used with metodo=listarTodos and nomeClasse=DestinoControle, an attacker can redirect users to arbitrary external sites. This can be abused for phishing attacks, credential theft, malware distribution, and social engineering that exploit the trusted WeGIA domain. The weakness is classified as CWE‑601, and the CVSS score of 4.8 indicates a medium impact.

The flaw affects installations of WeGIA published by LabRedesCefetRJ, specifically versions up to and including 3.6.1. The latest release, 3.6.2, incorporates input validation that removes the vulnerability. Any deployment of WeGIA that has not been updated to 3.6.2 remains vulnerable.

With a CVSS score of 4.8, the issue is considered medium severity. The EPSS score of less than 1 percent suggests exploitation is currently unlikely, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be the crafting of a malicious URL containing a nextPage value that points to an external host; the attacker then lures a user into visiting that URL. No special privileges or code execution are required, making the exploitation path low effort for an adversary while the trusted domain increases attack success probability.