ZeroDay Findings
Sign inSign up

Findings

CVE-2026-35474

WeGIA is a Web manager for charitable institutions.

Published Apr 6, 2026 · updated Jul 24, 2026 · wegia wegia

WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, open redirect has been found in WeGIA webapp. The redirect parameter is taken directly from $_GET with no URL validation or whitelist check, then used verbatim in a header("Location: ...") call. This vulnerability is fixed in 3.6.9.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 6, 2026 · NIST NVD

    Detected

    WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, open redirect has been found in WeGIA webapp. The redirect parameter is taken directly from $_GET with no URL validation or whitelist check, then used verbatim in a header("Location: ...") call. This vulnerability is fixed in 3.6.9.

  2. Jul 24, 2026 · NIST NVD

    Updated

    WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, open redirect has been found in WeGIA webapp. The redirect parameter is taken directly from $_GET with no URL validation or whitelist check, then used verbatim in a header("Location: ...") call. This vulnerability is fixed in 3.6.9.

Affected

  • cpe wegia/wegiaversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-35474

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-35474

    WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, open redirect has been found in WeGIA webapp. The redirect parameter is taken directly from $_GET with no URL validation or whitelist check, then used verbatim in a header("Location: ...") call. This vulnerabilit

    nvd.nist.gov

References