CVE-2026-35475

EUVD-2026-19510
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, the redirect parameter is taken directly from $_GET with no URL validation or whitelist check, then used verbatim in a header("Location: ...") call. This vulnerability is fixed in 3.6.9.
Open Redirect
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
UNKNOWN
---
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qfpg-6jh6-jx6p
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qfpg-6jh6-jx6p