CVE-2025-24020

WeGIA is a Web manager for charitable institutions. An Open Redirect vulnerability was identified in the `control.php` endpoint of versions up to and including 3.2.10 of the WeGIA application. The vulnerability allows the `nextPage` parameter to be manipulated, redirecting authenticated users to arbitrary external URLs without validation. The issue stems from the lack of validation for the `nextPage` parameter, which accepts external URLs as redirection destinations. This vulnerability can be exploited to perform phishing attacks or redirect users to malicious websites. Version 3.2.11 contains a fix for the issue.

• CWE-601

• https://github.com/LabRedesCefetRJ/WeGIA/commit/89d98bf074cebf6c4ed95fca6f64e325c0b1d2f0Patch
• https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/v3.2.11Release Notes
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-27g8-5q48-xmw6Exploit, Vendor Advisory

Published

Jan 21, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-24015Deno is a JavaScript, TypeScript, and WebAssembly runtime. V…5.3
• CVE-2025-24016Wazuh is a free and open source platform used for threat pre…9.9
• CVE-2025-24017YesWiki is a wiki system written in PHP. Versions up to and …6.1
• CVE-2025-24018YesWiki is a wiki system written in PHP. In versions up to a…5.4
• CVE-2025-24019YesWiki is a wiki system written in PHP. In versions up to a…7.1
• CVE-2025-2402A hard-coded, non-random password for the object store (mini…8.6
• CVE-2025-24021iTop is an web based IT Service Management tool. Prior to ve…5
• CVE-2025-24022iTop is an web based IT Service Management tool. Prior to ve…8.5
• CVE-2025-24023Flask-AppBuilder is an application development framework. Pr…5.3
• CVE-2025-24024Mjolnir is a moderation tool for Matrix. Mjolnir v1.9.0 resp…9.1
• CVE-2025-24025Coolify is an open-source and self-hostable tool for managin…6.1
• CVE-2025-24026iTop is an web based IT Service Management tool. Versions pr…5.3