The WeGIA web manager contains an unvalidated redirect in its control.php endpoint. When the metodo parameter is set to listarTodos and the nomeClasse to EstoqueControle, the nextPage query string is forwarded directly to the browser. Attacker-controlled values can cause a user to be sent to any external site, enabling phishing, credential harvest, malware delivery, or social‑engineering attacks through a URL that appears to originate from the trusted WeGIA domain.

Any instance of WeGIA deployed by LabRedesCefetRJ and running a version older than 3.6.9 is affected. The vulnerability manifests when /WeGIA/controle/control.php is accessed with the vulnerable combination of parameters.

The CVSS score of 5.1 indicates a moderate risk. Exploitation requires no user authentication—an attacker only needs to supply a crafted link. Although the probability of exploitation currently is not quantified, open‑redirects are frequently leveraged in phishing campaigns. Because this issue is not in the known exploited vulnerabilities list, it may be overlooked, but its potential for abuse remains significant.