The WeGIA application, a web manager for charitable institutions, contains an Open Redirect vulnerability (CWE-601) in versions before 3.6.9. Specifically, the /WeGIA/controle/control.php endpoint improperly handles the nextPage parameter when combined with metodo=listarId and nomeClasse=IsaidaControle, failing to validate or restrict redirection targets. This allows attackers to redirect users to arbitrary external URLs, potentially enabling phishing and other social engineering attacks. The vulnerability is addressed in WeGIA version 3.6.9.

Successful exploitation allows attackers to redirect users from the legitimate WeGIA domain to arbitrary external websites. This can be abused for phishing attacks, credential theft, malware distribution, and social engineering, leveraging user trust in the WeGIA domain. The CVSS 4.0 base score is 5.1, indicating a medium severity impact. There are no known exploits in the wild at this time.

This vulnerability is fixed in WeGIA version 3.6.9. Users and administrators should upgrade to version 3.6.9 or later to remediate this issue. No other official remediation or temporary fixes are documented. Patch status is not explicitly stated beyond the fix in 3.6.9, so verifying with the vendor for the latest advisory is recommended.