BaseFortify

Publication date: 2025-10-02

Last updated on: 2025-10-07

Assigner: GitHub, Inc.

Description

WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an Open Redirect vulnerability, identified in the control.php endpoint, specifically in the nextPage parameter (metodo=listarUmnomeClasse=FuncionarioControle). This vulnerability allows attackers to redirect users to arbitrary external domains, enabling phishing campaigns, malicious payload distribution, or user credential theft. This issue is fixed in version 3.5.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-02

Last Modified

2025-10-07

Generated

2026-07-06

AI Q&A

2025-10-02

EPSS Evaluated

2026-07-05

NVD

CVE-2025-61606

Affected Vendors & Products

Vendor	Product	Version / Range
wegia	wegia	to 3.5.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Executive Summary

This vulnerability is an Open Redirect in WeGIA versions 3.4.12 and below, specifically in the control.php endpoint's nextPage parameter. It allows attackers to redirect users to arbitrary external domains, which can be exploited for phishing, distributing malicious payloads, or stealing user credentials. The issue is fixed in version 3.5.0.

Impact Analysis

The vulnerability can impact you by enabling attackers to redirect your users to malicious websites. This can lead to phishing attacks, where users may be tricked into providing sensitive information, distribution of malware, or theft of user credentials, potentially compromising user accounts and data.

Mitigation Strategies

Upgrade WeGIA to version 3.5.0 or later, as this version contains the fix for the Open Redirect vulnerability in the control.php endpoint. Until the upgrade can be performed, avoid using or exposing the vulnerable nextPage parameter to untrusted input to reduce the risk of exploitation.

Hi! I’m here to help you understand CVE-2025-61606. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70