CVE-2026-35475: Wegia

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, the redirect parameter is taken directly from $_GET with no URL validation or whitelist check, then used verbatim in a header("Location: ...") call. This vulnerability is fixed in 3.6.9.

Affected products

• Wegia Wegia: before 3.6.9 (fixed in 3.6.9)

Published 2026-04-06. Last modified 2026-07-24.