WeGIA, a web manager for charitable institutions, contains an open redirect flaw in its control.php endpoint. The nextPage parameter is accepted without validation when metodo equals listarTodos or listarId_Nome and nomeClasse is OrigemControle. Attackers can supply any URL to the parameter, causing the application to redirect end users to that location. This flaw is a classic example of an unchecked redirect (CWE‑601) that can be leveraged for phishing, credential theft, malicious downloads or social engineering attacks under the guise of the legitimate WeGIA domain.

The vulnerability affects the WeGIA application developed by LabRedesCefetRJ. Versions prior to 3.6.9 are vulnerable; version 3.6.9 and later contain the fix. No other versions are mentioned.

The CVSS score is 5.1, indicating moderate severity. The likelihood of exploitation is not quantified in EPSS and the flaw is not listed in CISA’s KEV catalog. Exploitation requires only the ability to provide a malicious nextPage URL, which can be triggered by a user clicking a link or visiting a crafted page. Because the vulnerability does not require authentication or elevated privileges, it is considered easy to exploit in the wild and represents a realistic phishing vector for attackers.