PT-2026-30737 · Wegia · Wegia

Dapickle · CVE-2026-35472 · Published 2026-04-06 · Updated 2026-04-06

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.6.9

Description The WeGIA application, a web manager for charitable institutions, contains an Open Redirect flaw in the /WeGIA/controle/control.php endpoint. The issue stems from insufficient validation of the nextPage parameter when used with metodo=listarTodos and nomeClasse=EstoqueControle, allowing attackers to redirect users to arbitrary external websites. This can be leveraged for phishing attacks, credential theft, malware distribution, and social engineering attacks using the trusted WeGIA domain.

Recommendations Update to version 3.6.9 or later.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-35472

GHSA-H8WM-6XHV-R547

Affected Products

Wegia

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35472.json · Exploit
• 🔥 https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-h8wm-6xhv-r547 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-35472 · Security Note
• https://osv.dev/vulnerability/CVE-2026-35472 · Vendor Advisory
• https://twitter.com/infoflowcloud/status/2041283892607332622 · Twitter Post
• https://twitter.com/CVEnew/status/2041282891133677597 · Twitter Post