CVE-2025-61606: WeGIA: Open Redirect Vulnerability in `control.php` endpoint
WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an Open Redirect vulnerability, identified in the control.php endpoint, specifically in the nextPage parameter (metodo=listarUmnomeClasse=FuncionarioControle). This vulnerability allows attackers to redirect users to arbitrary external domains, enabling phishing campaigns, malicious payload distribution, or user credential theft. This issue is fixed in version 3.5.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIAto a version that resolves this vulnerability.Fixed in 3.5.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61606?
CVE-2025-61606 is considered a moderate severity vulnerability due to its potential for exploitation through open redirect attacks.
How do I fix CVE-2025-61606?
To fix CVE-2025-61606, upgrade WeGIA to version 3.5.0 or later, which addresses the open redirect vulnerability.
Which versions of WeGIA are affected by CVE-2025-61606?
CVE-2025-61606 affects WeGIA versions 3.4.12 and below.
What type of vulnerability is CVE-2025-61606?
CVE-2025-61606 is an Open Redirect vulnerability found in the control.php endpoint.
Can CVE-2025-61606 be exploited remotely?
Yes, CVE-2025-61606 can be exploited remotely by an attacker to redirect users to malicious sites.