CVE-2026-35398 LabRedesCefetRJ CVE debrief

Who should care

Users of WeGIA version prior to 3.6.9 should be aware of this Open Redirect vulnerability and take necessary actions to upgrade to the latest version. This includes administrators, security teams, and operators who manage or use the WeGIA application. They should review the CVE record and NVD entry for more information and implement necessary mitigations.

Technical summary

The Open Redirect vulnerability in WeGIA allows attackers to redirect users to arbitrary external websites by manipulating the nextPage parameter in the /WeGIA/controle/control.php endpoint. This can lead to phishing attacks, credential theft, malware distribution, and social engineering. The vulnerability is fixed in version 3.6.9 of the WeGIA application. Affected users should upgrade to the latest version to mitigate this vulnerability. The vulnerability has a CVSS score of 5.1 and a severity of MEDIUM.

Defensive priority

Medium

Recommended defensive actions

• Upgrade to WeGIA version 3.6.9 or later
• Implement input validation and sanitization for the nextPage parameter
• Monitor for suspicious activity and implement logging and auditing
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-04-06T21:16:21.740Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The WeGIA application, a Web manager for charitable institutions, is affected by an Open Redirect vulnerability prior to version 3.6.9. This vulnerability exists in the /WeGIA/controle/control.php endpoint, specifically through the nextPage parameter when combined with metodo=listarTodos & listarId_Nome and nomeClasse=OrigemControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain. Evidence of this vulnerability is based on the CVE record and NVD entry.

Official resources