CVE-2026-23728

CVE-2026-23728 is an Open Redirect vulnerability in WeGIA, a web manager for charitable institutions, affecting versions prior to 3.6.2. Specifically, the /WeGIA/controle/control.php endpoint's nextPage parameter, when combined with specific other parameters, can be manipulated to redirect users to arbitrary external websites. This medium-severity vulnerability (CVSS 6.1) has a network attack vector and low attack complexity, potentially leading to phishing, credential theft, or malware distribution. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.