EUVD-2026-32566Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionGitHub Advisory
WeGIA is a web manager for charitable institutions. Prior to 3.7.3, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarTodos and nomeClasse=InternoControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain. This vulnerability is fixed in 3.7.3.
AnalysisAI
Open redirect in WeGIA before version 3.7.3 enables authenticated attackers to weaponize the trusted WeGIA domain for phishing, credential harvesting, and malware distribution by manipulating the unvalidated nextPage parameter at the /WeGIA/controle/control.php endpoint. Affected deployments include any WeGIA instance running versions prior to 3.7.3 where the control endpoint is accessible to low-privileged authenticated users. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the social engineering abuse potential against users who trust the institution's domain is the primary real-world risk.
Technical ContextAI
WeGIA is a PHP-based web management application designed for charitable institutions (EUVD-2026-32566, tags: PHP). The vulnerable endpoint /WeGIA/controle/control.php accepts a nextPage parameter that, when combined with query parameters metodo=listarTodos and nomeClasse=InternoControle, performs a server-side redirect without validating or restricting the destination URL. This maps directly to CWE-601 (URL Redirection to Untrusted Site / 'Open Redirect'), a class of vulnerability where insufficient input validation on redirect targets allows the application to transparently forward users to attacker-controlled external sites. Because the redirect originates from a legitimate institutional domain, browser security indicators and email link scanners are less likely to flag the initial URL, amplifying phishing effectiveness.
RemediationAI
Vendor-released patch: WeGIA 3.7.3. Upgrade to version 3.7.3 or later immediately, as confirmed by the GitHub Security Advisory at https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-x85f-76c9-qw3x. If an immediate upgrade is not feasible, a compensating control is to restrict access to the /WeGIA/controle/control.php endpoint via web server configuration (e.g., nginx location block or Apache .htaccess rules) so that only internal trusted IPs or authorized roles can reach it - note this may disrupt legitimate control panel functionality and should be tested. An additional mitigation is to deploy a WAF rule that blocks or sanitizes requests to control.php where the nextPage parameter begins with http:// or https:// pointing to external domains; however, WAF bypass is possible through URL encoding or relative-path confusion and should not substitute for patching.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today