What’s Vulnerable › Vulnerabilities

CVE-2025-62361: WeGIA Open Redirect Vulnerability in `control.php` endpoint `nextPage` parameter (metodo=listarTodos nomeClasse=AlmoxarifeControle)

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-10-13 · updated 2026-10-08
• Weakness: CWE-601

Description

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.0, an Open Redirect vulnerability was identified in the control.php endpoint of the WeGIA application, specifically in the nextPage parameter (metodo=listarTodos nomeClasse=AlmoxarifeControle). This vulnerability allows attackers to redirect users to arbitrary external domains, enabling phishing campaigns, malicious payload distribution, or user credential theft. This vulnerability is fixed in 3.5.0.

Affected products

• LabRedesCefetRJ WeGIA: before 3.5.0 — fixed in 3.5.0

How to fix

Upgrade to a fixed version: LabRedesCefetRJ WeGIA 3.5.0. Check the vendor advisory for mitigations.

References

• https://github.com/LabRedesCefetRJ/WeGIA/commit/2b53003b5956dbbf0ce554b680245f55ad869821
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-m99c-77f2-gpjx

Get alerted when CVE-2025-62361 or the next vulnerability affects your stack