CVE-2026-35474

WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, open redirect has been found in WeGIA webapp. The redirect parameter is taken directly from $_GET with no URL validation or whitelist check, then used verbatim in a header("Location: ...") call. This vulnerability is fixed in 3.6.9.

• CWE-601

• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-7935-g3wg-h55wExploit, Vendor Advisory
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-7935-g3wg-h55wExploit, Vendor Advisory

Published

Apr 6, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35469spdystream is a Go library for multiplexing streams over SPD…6.5
• CVE-2026-3547Out-of-bounds read in ALPN parsing due to incomplete validat…7.5
• CVE-2026-35470OpenSTAManager is an open source management software for tec…8.8
• CVE-2026-35471goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-be…9.8
• CVE-2026-35472WeGIA is a Web manager for charitable institutions. Prior to…6.1
• CVE-2026-35473WeGIA is a Web manager for charitable institutions. Prior to…6.1
• CVE-2026-35475WeGIA is a Web manager for charitable institutions. Prior to…6.1
• CVE-2026-35476InvenTree is an Open Source Inventory Management System. Pri…4.3
• CVE-2026-35477InvenTree is an Open Source Inventory Management System. Fro…9.9
• CVE-2026-35478InvenTree is an Open Source Inventory Management System. Fro…8.1
• CVE-2026-35479InvenTree is an Open Source Inventory Management System. Pri…4.7
• CVE-2026-3548Two buffer overflow vulnerabilities existed in the wolfSSL C…9.8