The WeGIA web management platform for charitable organisations has an open redirect flaw in its control.php endpoint, triggered when the nextPage GET parameter is used together with metodo=listarId and nomeClasse=IentradaControle. The application does not validate or constrain the nextPage value, allowing an attacker to supply any URL so that the user is redirected to an external site. This can be leveraged for phishing, credential harvesting, malware delivery, and other social‑engineering attacks that exploit the trusted WeGIA domain. The weakness corresponds to a standard Unvalidated Redirect or Forward (CWE-601).

Affected versions are all releases of the WeGIA application before 3.6.9. The vulnerability exists in the /WeGIA/controle/control.php component of the web manager. The 3.6.9 release and later contain a fix that validates the nextPage parameter. The product is developed by LabRedesCefetRJ and identified in the advisory as the WeGIA application.

The CVSS score is 5.1, indicating moderate severity, and the EPSS is below 1% suggesting a low likelihood of exploitation at this time. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. Attackers could exploit the flaw by simply triggering a crafted URL that the user follows, thereby redirecting them to a malicious site. Even with low probability, the potential for phishing and credential theft warrants prompt remediation.