Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
245 results · page 4 of 5
Feb 18, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.CVE-2025-26611 · Other software · LabRedesCefetRJ · reported by GitHubCritical 10
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, `remover_produto.php` endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing unauthorized access to sensitive information. This issue has been addressed in version 3.2.13 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.CVE-2025-26610 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.4
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, `restaurar_produto_desocultar.php` endpoint. This vulnerability allow an authorized attacker to execute arbitrary SQL queries, allowing access to sensitive information. This issue has been addressed in version 3.2.13 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.CVE-2025-26609 · Other software · LabRedesCefetRJ · reported by GitHubCritical 10
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, `familiar_docfamiliar.php` endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing unauthorized access to sensitive information. This issue has been addressed in version 3.2.14 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.CVE-2025-26608 · Other software · LabRedesCefetRJ · reported by GitHubCritical 10
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, `dependente_docdependente.php` endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing unauthorized access to sensitive information. This issue has been addressed in version 3.2.13 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.CVE-2025-26607 · Other software · LabRedesCefetRJ · reported by GitHubCritical 10
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, `documento_excluir.php` endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing unauthorized access to sensitive information. This issue has been addressed in version 3.2.13 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.CVE-2025-26606 · Other software · LabRedesCefetRJ · reported by GitHubCritical 10
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, `informacao_adicional.php` endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing unauthorized access to sensitive information. This issue has been addressed in version 3.2.13 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.CVE-2025-26605 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.4
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, `deletar_cargo.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to sensitive information. This issue has been addressed in version 3.2.13 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2025A vulnerability in Simple Network Management Protocol (SNMP) polling for Cisco Secure Email and Web Manager, Cisco Secure Email Gateway, and Cisco Secure Web ApCVE-2025-20207 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
A vulnerability in Simple Network Management Protocol (SNMP) polling for Cisco Secure Email and Web Manager, Cisco Secure Email Gateway, and Cisco Secure Web Appliance could allow an authenticated, remote attacker to obtain confidential information about the underlying operating system. This vulnerability exists because the appliances do not protect confidential information at rest in response to SNMP poll requests. An attacker could exploit this vulnerability by sending a crafted SNMP poll request to the affected appliance. A successful exploit could allow the attacker to discover confidential information that should be restricted. To exploit this vulnerability, an attacker must have the configured SNMP credentials.
- Product
- Cisco Secure Email
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Feb 5, 2025A vulnerability in the implementation of the remote access functionality of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Cisco Secure Email GaCVE-2025-20185 · Network & remote access · Cisco · reported by psirt@cisco.comLow 3.4
A vulnerability in the implementation of the remote access functionality of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Cisco Secure Email Gateway, and Cisco Secure Web Appliance could allow an authenticated, local attacker to elevate privileges to root. The attacker must authenticate with valid administrator credentials. This vulnerability is due to an architectural flaw in the password generation algorithm for the remote access functionality. An attacker could exploit this vulnerability by generating a temporary password for the service account. A successful exploit could allow the attacker to execute arbitrary commands as root and access the underlying operating system. Note: The Security Impact Rating (SIR) for this vulnerability is Medium due to the unrestricted scope of information that is accessible to an attacker.
- Product
- Cisco Secure Email
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Feb 5, 2025A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway could allow an aCVE-2025-20180 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.8
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid credentials for a user account with at least the role of Operator.
- Product
- Cisco Secure Email
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Feb 3, 2025WeGIA is a Web Manager for Charitable Institutions.CVE-2025-24958 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.4
WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `salvar_tag.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025WeGIA is a Web Manager for Charitable Institutions.CVE-2025-24957 · Other software · LabRedesCefetRJ · reported by GitHubCritical 10
WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_detalhes_socio.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025WeGIA is a Web Manager for Charitable Institutions.CVE-2025-24906 · Other software · LabRedesCefetRJ · reported by GitHubCritical 10
WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_detalhes_cobranca.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025WeGIA is a Web Manager for Charitable Institutions.CVE-2025-24905 · Other software · LabRedesCefetRJ · reported by GitHubCritical 10
WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_codigobarras_cobranca.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025WeGIA is a Web Manager for Charitable Institutions.CVE-2025-24902 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.4
WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `salvar_cargo.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2025WeGIA is a Web Manager for Charitable Institutions.CVE-2025-24901 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.4
WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `deletar_permissao.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 21, 2025WeGIA is a Web manager for charitable institutions.CVE-2025-24020 · Other software · LabRedesCefetRJ · reported by GitHubMedium 4.8
WeGIA is a Web manager for charitable institutions. An Open Redirect vulnerability was identified in the `control.php` endpoint of versions up to and including 3.2.10 of the WeGIA application. The vulnerability allows the `nextPage` parameter to be manipulated, redirecting authenticated users to arbitrary external URLs without validation. The issue stems from the lack of validation for the `nextPage` parameter, which accepts external URLs as redirection destinations. This vulnerability can be exploited to perform phishing attacks or redirect users to malicious websites. Version 3.2.11 contains a fix for the issue.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2025WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions.CVE-2025-23220 · Other software · LabRedesCefetRJ · reported by GitHubCritical 10
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in the WeGIA application, specifically in the adicionar_raca.php endpoint. This vulnerability allows attackers to execute arbitrary SQL commands in the database, allowing unauthorized access to sensitive information. During the exploit, it was possible to perform a complete dump of the application's database, highlighting the severity of the flaw. This vulnerability is fixed in 3.2.10.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2025WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions.CVE-2025-23219 · Other software · LabRedesCefetRJ · reported by GitHubCritical 10
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in the WeGIA application, specifically in the adicionar_cor.php endpoint. This vulnerability allows attackers to execute arbitrary SQL commands in the database, allowing unauthorized access to sensitive information. During the exploit, it was possible to perform a complete dump of the application's database, highlighting the severity of the flaw. This vulnerability is fixed in 3.2.10.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2025WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions.CVE-2025-23218 · Other software · LabRedesCefetRJ · reported by GitHubCritical 10
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in the WeGIA application, specifically in the adicionar_especie.php endpoint. This vulnerability allows attackers to execute arbitrary SQL commands in the database, allowing unauthorized access to sensitive information. During the exploit, it was possible to perform a complete dump of the application's database, highlighting the severity of the flaw. This vulnerability is fixed in 3.2.10.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions.CVE-2025-23038 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `remuneracao.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `descricao` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `remuneracao.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions.CVE-2025-23037 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `control.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `cargo` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `control.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions.CVE-2025-23036 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `pre_cadastro_funcionario.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the `msg_e` parameter. The application fails to validate and sanitize user inputs in the `msg_e` parameter. This lack of validation permits the injection of malicious payloads, which are reflected back to the user's browser in the server's response and executed within the context of the victim's browser. This issue has been addressed in version 3.2.7. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions.CVE-2025-23035 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_tipo_quadro_horario.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `tipo` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `adicionar_tipo_quadro_horario.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions.CVE-2025-23034 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `tags.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the `msg_e` parameter. The application fails to validate and sanitize user inputs in the `msg_e` parameter. This lack of validation permits the injection of malicious payloads, which are reflected back to the user's browser in the server's response and executed within the context of the victim's browser. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions.CVE-2025-23033 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_situacao.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `situacao` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `adicionar_situacao.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions.CVE-2025-23032 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_escala.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `escala` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `adicionar_escala.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions.CVE-2025-23031 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_alergia.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `nome` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `adicionar_alergia.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions.CVE-2025-23030 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `cadastro_funcionario.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the `cpf` parameter. The application fails to validate and sanitize user inputs in the `cpf` parameter. This lack of validation permits the injection of malicious payloads, which are reflected back to the user's browser in the server's response and executed within the context of the victim's browser. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions.CVE-2025-22619 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `editar_permissoes.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the `msg_c` parameter. The application fails to validate and sanitize user inputs in the `msg_c` parameter. This lack of validation permits the injection of malicious payloads, which are reflected back to the user's browser in the server's response and executed within the context of the victim's browser. This issue has been addressed in release version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions.CVE-2025-22618 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_cargo.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `cargo` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `adicionar_cargo.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in release version 3.2.6 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions.CVE-2025-22617 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `editar_socio.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the `socio` parameter. The application fails to validate and sanitize user inputs in the `socio` parameter. This lack of validation permits the injection of malicious payloads, which are reflected back to the user's browser in the server's response and executed within the context of the victim's browser. This issue has been addressed in version 3.2.7 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions.CVE-2025-22616 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `dependente_parentesco_adicionar.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `descricao` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `dependente_parentesco_adicionar.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions.CVE-2025-22615 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `Cadastro_Atendido.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the `cpf` parameter. The application fails to validate and sanitize user inputs in the `cpf` parameter. This lack of validation permits the injection of malicious payloads, which are reflected back to the user's browser in the server's response and executed within the context of the victim's browser. This issue has been addressed in version 3.2.6 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions.CVE-2025-22614 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `dependente_editarInfoPessoal.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `nome` and `SobrenomeForm`parameters. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `dependente_editarInfoPessoal.php` parameters. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2025WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions.CVE-2025-22613 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `informacao_adicional.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `descricao` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `informacao_adicional.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025WeGIA is a web manager for charitable institutions.CVE-2025-22600 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the configuracao_doacao.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the avulso parameter. This vulnerability is fixed in 3.2.8.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025WeGIA is a web manager for charitable institutions.CVE-2025-22599 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the home.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_c parameter. This vulnerability is fixed in 3.2.8.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025WeGIA is a web manager for charitable institutions.CVE-2025-22598 · Other software · LabRedesCefetRJ · reported by GitHubHigh 8.3
WeGIA is a web manager for charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the cadastrarSocio.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the local_recepcao parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. This vulnerability is fixed in 3.2.8.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025WeGIA is a web manager for charitable institutions.CVE-2025-22597 · Other software · LabRedesCefetRJ · reported by GitHubHigh 8.3
WeGIA is a web manager for charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the CobrancaController.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the local_recepcao parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. This vulnerability is fixed in 3.2.8.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 10, 2025WeGIA is a web manager for charitable institutions.CVE-2025-22596 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the modulos_visiveis.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_c parameter. This vulnerability is fixed in 3.2.8.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2025WeGIA is a web manager for charitable institutions.CVE-2025-22143 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the listar_permissoes.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_e parameter. This vulnerability is fixed in 3.2.8.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2025WeGIA is a web manager for charitable institutions.CVE-2025-22141 · Other software · nilsonLazarin · reported by GitHubCritical 9.4
WeGIA is a web manager for charitable institutions. A SQL Injection vulnerability was identified in the /dao/verificar_recursos_cargo.php endpoint, specifically in the cargo parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This vulnerability is fixed in 3.2.8.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2025WeGIA is a web manager for charitable institutions.CVE-2025-22140 · Other software · nilsonLazarin · reported by GitHubCritical 9.4
WeGIA is a web manager for charitable institutions. A SQL Injection vulnerability was identified in the /html/funcionario/dependente_listar_um.php endpoint, specifically in the id_dependente parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This vulnerability is fixed in 3.2.8.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 8, 2025WeGIA is a web manager for charitable institutions.CVE-2025-22139 · Other software · nilsonLazarin · reported by GitHubMedium 6.4
WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the configuracao_geral.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_c parameter. This vulnerability is fixed in 3.2.8.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025WeGIA is a web manager for charitable institutions.CVE-2025-22133 · Other software · nilsonLazarin · reported by GitHubCritical 9.9
WeGIA is a web manager for charitable institutions. Prior to 3.2.8, a critical vulnerability was identified in the /WeGIA/html/socio/sistema/controller/controla_xlsx.php endpoint. The endpoint accepts file uploads without proper validation, allowing the upload of malicious files, such as .phar, which can then be executed by the server. This vulnerability is fixed in 3.2.8.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2025WeGIA is a web manager for charitable institutions.CVE-2025-22132 · Other software · nilsonLazarin · reported by GitHubHigh 8.3
WeGIA is a web manager for charitable institutions. A Cross-Site Scripting (XSS) vulnerability was identified in the file upload functionality of the WeGIA/html/socio/sistema/controller/controla_xlsx.php endpoint. By uploading a file containing malicious JavaScript code, an attacker can execute arbitrary scripts in the context of a victim's browser. This can lead to information theft, session hijacking, and other forms of client-side exploitation. This vulnerability is fixed in 3.2.7.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 18, 2024A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA) could allow an aCVE-2021-1425 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.3
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Content Security Management Appliance (SMA) could allow an authenticated, remote attacker to access sensitive information on an affected device. The vulnerability exists because confidential information is being included in HTTP requests that are exchanged between the user and the device. An attacker could exploit this vulnerability by looking at the raw HTTP requests that are sent to the interface. A successful exploit could allow the attacker to obtain some of the passwords that are configured throughout the interface.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
- Product
- Cisco Secure Email and Web Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
Nov 6, 2024A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web AppCVE-2024-20504 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 5.4
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
- Product
- Cisco Secure Email
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.com
May 15, 2024A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager could allow an authenticated, remote attaCVE-2024-20383 · Network & remote access · Cisco · reported by psirt@cisco.comMedium 4.8
A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
- Product
- Cisco Secure Email and Web Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsec.cloudapps.cisco.comsec.cloudapps.cisco.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.