CVE-2026-35473: WeGIA - Open Redirect - IentradaControle - listarId() - Unvalidated $_GET['nextPage']
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarId and nomeClasse=IentradaControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain. This vulnerability is fixed in 3.6.9.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIAto a version that resolves this vulnerability.Fixed in 3.6.9Patch WeGIA - Open Redirect - IentradaControle - listarId() - Unvalidated $_GET['nextPage'] - Compensating control
If immediate upgrade to WeGIA 3.6.9 is not possible, add an external-web redirection protection at the perimeter (e.g., proxy/WAF) for requests to /WeGIA/controle/control.php with nextPage when metodo=listarId and nomeClasse=IentradaControle, blocking open-redirect-style arbitrary external destinations.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35473?
CVE-2026-35473 is classified as a moderate severity vulnerability due to the potential for open redirect attacks.
How do I fix CVE-2026-35473?
To fix CVE-2026-35473, update the WeGIA application to version 3.6.9 or later.
What is an open redirect vulnerability in CVE-2026-35473?
An open redirect vulnerability allows an attacker to redirect users to arbitrary websites, potentially leading to phishing attacks.
Which version of WeGIA is affected by CVE-2026-35473?
Versions prior to WeGIA 3.6.9 are affected by CVE-2026-35473.
What area of the WeGIA application does CVE-2026-35473 impact?
CVE-2026-35473 impacts the /WeGIA/controle/control.php endpoint of the WeGIA application.