CVE-2025-61606

MediumCVSS 6.1/10Last modified Oct 12, 2026

Description

WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an Open Redirect vulnerability, identified in the control.php endpoint, specifically in the nextPage parameter (metodo=listarUmnomeClasse=FuncionarioControle). This vulnerability allows attackers to redirect users to arbitrary external domains, enabling phishing campaigns, malicious payload distribution, or user credential theft. This issue is fixed in version 3.5.0.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

VendorProductVersions
LabRedesCefetRJWeGIA< 3.5.0

References

Timeline

Published
Oct 2, 2025
Last modified
Oct 12, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-616077.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additionCVE-2025-616087.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additionCVE-2025-616097.5In modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional CVE-2025-61619.8A vulnerability, which was classified as critical, was found in SourceCodester Simple Food Ordering System 1.0. Affected is an unknown functCVE-2025-616107.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additionCVE-2025-616117.5In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privilegeCVE-2025-616127.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additionCVE-2025-616137.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additionCVE-2025-616147.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additionCVE-2025-616157.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additionCVE-2025-616167.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additionCVE-2025-616177.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no addition
CVE-2025-61606: Medium severity, CVSS 6.1 | Vulnix