An unvalidated redirection parameter allows attackers to force users of the WeGIA application to arbitrary external sites. The flaw exists in the /WeGIA/controle/control.php endpoint when method=listarId and nomeClasse=IsaidaControle are used together with the nextPage parameter. Leveraging this, adversaries can deliver phishing pages, malware, or other social engineering content under the guise of the trusted WeGIA domain. The weakness maps to CWE‑601, indicating a missing validation of user-supplied URLs.

The vulnerability affects the WeGIA web manager produced by LabRedesCefetRJ. All releases prior to version 3.6.9 are impacted. The issue was fixed in the 3.6.9 build, so versions 3.6.9 and later are not vulnerable.

The CVSS score of 5.1 classifies the flaw as moderate severity, and the EPSS score of less than 1% suggests a low likelihood of current exploitation. It is not listed in the CISA KEV catalog. The attack vector is inferred to be web-based, requiring the attacker to entice or trick a user into clicking a crafted link pointing to the vulnerable endpoint. Once redirected, the user could be exposed to phishing or malware.