PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-35472 LabRedesCefetRJ CVE debrief

CVE-2026-35472 is an Open Redirect vulnerability in WeGIA, a Web manager for charitable institutions. The vulnerability was patched in version 3.6.9. This vulnerability allows attackers to redirect users to arbitrary external websites, which can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain. The vulnerability has a CVSS score of 5.1 and a severity of MEDIUM. Users of WeGIA version prior to 3.6.9 should apply the patch to prevent Open Redirect attacks.

Vendor
LabRedesCefetRJ
Product
WeGIA
CVSS
MEDIUM 5.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-06
Original CVE updated
2026-07-24
Advisory published
2026-04-06
Advisory updated
2026-07-24

Who should care

Users of WeGIA version prior to 3.6.9 should apply the patch to prevent Open Redirect attacks. This includes operators, administrators, and security teams responsible for managing WeGIA deployments. They should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance.

Technical summary

CVE-2026-35472 is an Open Redirect vulnerability in the /WeGIA/controle/control.php endpoint of the WeGIA application. The vulnerability is caused by the lack of validation or restriction of the nextPage parameter when combined with metodo=listarTodos and nomeClasse=EstoqueControle. This allows attackers to redirect users to arbitrary external websites, which can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain. The vulnerability has a CVSS score of 5.1 and a severity of MEDIUM.

Defensive priority

Apply patch version 3.6.9 to prevent Open Redirect attacks.

Recommended defensive actions

  • Apply patch version 3.6.9
  • Validate user input
  • Restrict redirects to trusted domains
  • Monitor for suspicious activity
  • Review compensating controls for exposed systems
  • Check relevant monitoring, detection, and logs for exposed assets
  • Track exceptions and retest remediated assets

Evidence notes

The CVE record was published on 2026-04-06T21:16:22.040Z and was last modified on 2026-07-24T21:10:00.143Z. The NVD entry is currently Analyzed. The WeGIA application, a Web manager for charitable institutions, is affected by this vulnerability. Users should verify their deployments and apply the patch to prevent Open Redirect attacks. The CVE record provides limited source detail, and defenders should review the official advisory for more information.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-35472 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-35472

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-35472 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-35472

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.