CVE-2026-45335: WeGIA: Middleware whitelist bypass → open redirect via InternoControle.nextPage
WeGIA is a web manager for charitable institutions. Prior to 3.7.3, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarTodos and nomeClasse=InternoControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain. This vulnerability is fixed in 3.7.3.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45335?
CVE-2026-45335 has a severity rating of medium with a score of 5.4.
How do I fix CVE-2026-45335?
The recommended fix for CVE-2026-45335 is to update the WeGIA application to version 3.7.3 or later.
What type of vulnerability is CVE-2026-45335?
CVE-2026-45335 is classified as an Open Redirect vulnerability.
What is the impact of CVE-2026-45335?
The impact of CVE-2026-45335 allows attackers to redirect users to potentially malicious sites through the application.
In which version of WeGIA is CVE-2026-45335 present?
CVE-2026-45335 is present in WeGIA versions prior to 3.7.3.