Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
502 results · page 6 of 11
Jul 7, 2025WeGIA is a web manager for charitable institutions.CVE-2025-53527 · Other software · LabRedesCefetRJ · reported by GitHubHigh 8.3
WeGIA is a web manager for charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in the almox parameter of the /controle/relatorio_geracao.php endpoint. This issue allows attacker to inject arbitrary SQL queries, potentially leading to unauthorized data access or further exploitation depending on database configuration. This vulnerability is fixed in 3.4.1.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2025WeGIA is a web manager for charitable institutions.CVE-2025-53526 · Other software · LabRedesCefetRJ · reported by GitHubLow 2
WeGIA is a web manager for charitable institutions. An XSS Injection vulnerability was identified in novo_memorando.php. After the memo was submitted, the vulnerability was confirmed by accessing listar_memorandos_antigos.php. Upon loading this page, the injected script was executed in the browser. This vulnerability is fixed in 3.4.3.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2025WeGIA is a web manager for charitable institutions.CVE-2025-53525 · Other software · LabRedesCefetRJ · reported by GitHubLow 2
WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the profile_familiar.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the id_dependente parameter. This vulnerability is fixed in 3.4.3.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2025WeGIA is a web manager for charitable institutions.CVE-2025-53377 · Other software · LabRedesCefetRJ · reported by GitHubLow 2
WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the cadastro_dependente_pessoa_nova.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the id_funcionario parameter. This vulnerability is fixed in 3.4.3.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 27, 2025WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions.CVE-2025-53091 · Other software · LabRedesCefetRJ · reported by GitHubCritical 10
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in version 3.3.3 the almox parameter of the `/controle/getProdutosPorAlmox.php` endpoint. This issue allows any unauthenticated attacker to inject arbitrary SQL queries, potentially leading to unauthorized data access or further exploitation depending on database configuration. Version 3.4.0 fixes the issue.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2025A vulnerability classified as problematic has been found in LabRedesCefetRJ WeGIA 3.4.0.CVE-2025-6699 · Other software · LabRedesCefetRJ · reported by VulDBLow 2
A vulnerability classified as problematic has been found in LabRedesCefetRJ WeGIA 3.4.0. This affects an unknown part of the file /html/funcionario/cadastro_funcionario.php of the component Cadastro de Funcionário. The manipulation of the argument Nome/Sobrenome leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. This is a different issue than CVE-2025-23030. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2025A vulnerability was found in LabRedesCefetRJ WeGIA 3.4.0.CVE-2025-6698 · Other software · LabRedesCefetRJ · reported by VulDBLow 2
A vulnerability was found in LabRedesCefetRJ WeGIA 3.4.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /html/matPat/adicionar_tipoSaida.php of the component Adicionar tipo. The manipulation of the argument Insira o novo tipo leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2025A vulnerability was found in LabRedesCefetRJ WeGIA 3.4.0.CVE-2025-6697 · Other software · LabRedesCefetRJ · reported by VulDBLow 2
A vulnerability was found in LabRedesCefetRJ WeGIA 3.4.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /html/matPat/adicionar_tipoEntrada.php of the component Adicionar tipo. The manipulation of the argument Insira o novo tipo leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2025A vulnerability was found in LabRedesCefetRJ WeGIA 3.4.0.CVE-2025-6696 · Other software · LabRedesCefetRJ · reported by VulDBLow 2
A vulnerability was found in LabRedesCefetRJ WeGIA 3.4.0. It has been classified as problematic. Affected is an unknown function of the file /html/atendido/Cadastro_Atendido.php of the component Cadastro de Atendio. The manipulation of the argument Nome/Sobrenome leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This is a different issue than CVE-2025-22615. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2025A vulnerability was found in LabRedesCefetRJ WeGIA 3.4.0 and classified as problematic.CVE-2025-6695 · Other software · LabRedesCefetRJ · reported by VulDBLow 2
A vulnerability was found in LabRedesCefetRJ WeGIA 3.4.0 and classified as problematic. This issue affects some unknown processing of the file /html/matPat/adicionar_categoria.php of the component Additional Categoria. The manipulation of the argument Insira a nova categoria leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2025A vulnerability has been found in LabRedesCefetRJ WeGIA 3.4.0 and classified as problematic.CVE-2025-6694 · Other software · LabRedesCefetRJ · reported by VulDBLow 2
A vulnerability has been found in LabRedesCefetRJ WeGIA 3.4.0 and classified as problematic. This vulnerability affects unknown code of the file /html/matPat/adicionar_unidade.php of the component Adicionar Unidade. The manipulation of the argument Insira a nova unidade leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025WeGIA is a web manager for charitable institutions.CVE-2025-52474 · Other software · LabRedesCefetRJ · reported by GitHubHigh 8.3
WeGIA is a web manager for charitable institutions. Prior to version 3.4.2, a SQL Injection vulnerability was identified in the id parameter of the /WeGIA/controle/control.php endpoint. This vulnerability allows attacker to manipulate SQL queries and access sensitive database information, such as table names and sensitive data. This issue has been patched in version 3.4.2.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 19, 2025WeGIA is a web manager for charitable institutions.CVE-2025-50201 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.8
WeGIA is a web manager for charitable institutions. Prior to version 3.4.2, an OS Command Injection vulnerability was identified in the /html/configuracao/debug_info.php endpoint. The branch parameter is not properly sanitized before being concatenated and executed in a shell command on the server's operating system. This flaw allows an unauthenticated attacker to execute arbitrary commands on the server with the privileges of the web server user (www-data). This issue has been patched in version 3.4.2.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2025Missing Authorization vulnerability in Drupal Bookable Calendar allows Forceful Browsing.This issue affects Bookable Calendar: from 0.0.0 before 2.2.13.CVE-2025-48916 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.5
Missing Authorization vulnerability in Drupal Bookable Calendar allows Forceful Browsing.This issue affects Bookable Calendar: from 0.0.0 before 2.2.13.
- Product
- Bookable Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2025Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0.CVE-2025-48444 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 5.3
Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0.
- Product
- Quick Node Block
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 11, 2025Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0.CVE-2025-48013 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 5.3
Missing Authorization vulnerability in Drupal Quick Node Block allows Forceful Browsing.This issue affects Quick Node Block: from 0.0.0 before 2.0.0.
- Product
- Quick Node Block
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025Missing Authorization vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Forceful Browsing.This issue affects Enterprise MFA - TFA for Drupal: from CVE-2025-47709 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 6.5
Missing Authorization vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Forceful Browsing.This issue affects Enterprise MFA - TFA for Drupal: from 0.0.0 before 4.7.0, from 5.0.0 before 5.2.0.
- Product
- Enterprise MFA - TFA for Drupal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 7, 2025WeGIA is a web manager for charitable institutions.CVE-2025-46828 · Other software · LabRedesCefetRJ · reported by GitHubCritical 10
WeGIA is a web manager for charitable institutions. An unauthenticated SQL Injection vulnerability was identified in versions up to and including 3.3.0 in the endpoint `/html/socio/sistema/get_socios.php`, specifically in the query parameter. This issue allows attackers to inject and execute arbitrary SQL statements against the application's underlying database. As a result, it may lead to data exfiltration, authentication bypass, or complete database compromise. Version 3.3.1 fixes the issue.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 5, 2025An issue in the /usr/local/bin/jncs.sh script of Gefen WebFWC (In AV over IP products) v1.85h, v1.86v, and v1.70 allows attackers with network access to connectCVE-2025-25504 · Other software · Niceforyou · reported by MITREMedium 6.5
An issue in the /usr/local/bin/jncs.sh script of Gefen WebFWC (In AV over IP products) v1.85h, v1.86v, and v1.70 allows attackers with network access to connect to the device over TCP port 4444 without authentication and execute arbitrary commands with root privileges.
- Product
- Gefen Webfwc
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 1, 2025In the Linux kernel, the following vulnerability has been resolved: fbdev: hyperv_fb: Allow graceful removal of framebuffer When a Hyper-V framebuffer device CVE-2025-21976 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67High 7.8
In the Linux kernel, the following vulnerability has been resolved: fbdev: hyperv_fb: Allow graceful removal of framebuffer When a Hyper-V framebuffer device is unbind, hyperv_fb driver tries to release the framebuffer forcefully. If this framebuffer is in use it produce the following WARN and hence this framebuffer is never released. [ 44.111220] WARNING: CPU: 35 PID: 1882 at drivers/video/fbdev/core/fb_info.c:70 framebuffer_release+0x2c/0x40 < snip > [ 44.111289] Call Trace: [ 44.111290] <TASK> [ 44.111291] ? show_regs+0x6c/0x80 [ 44.111295] ? __warn+0x8d/0x150 [ 44.111298] ? framebuffer_release+0x2c/0x40 [ 44.111300] ? report_bug+0x182/0x1b0 [ 44.111303] ? handle_bug+0x6e/0xb0 [ 44.111306] ? exc_invalid_op+0x18/0x80 [ 44.111308] ? asm_exc_invalid_op+0x1b/0x20 [ 44.111311] ? framebuffer_release+0x2c/0x40 [ 44.111313] ? hvfb_remove+0x86/0xa0 [hyperv_fb] [ 44.111315] vmbus_remove+0x24/0x40 [hv_vmbus] [ 44.111323] device_remove+0x40/0x80 [ 44.111325] device_release_driver_internal+0x20b/0x270 [ 44.111327] ? bus_find_device+0xb3/0xf0 Fix this by moving the release of framebuffer and assosiated memory to fb_ops.fb_destroy function, so
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Mar 31, 2025Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing.This issue affects Two-factor Authentication (TFA): froCVE-2025-31694 · Websites & servers · Drupal · reported by mlhess@drupal.orgHigh 8.1
Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing.This issue affects Two-factor Authentication (TFA): from 0.0.0 before 1.10.0.
- Product
- Two-factor Authentication (TFA)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Missing Authorization vulnerability in Drupal OAuth2 Server allows Forceful Browsing.This issue affects OAuth2 Server: from 0.0.0 before 2.1.0.CVE-2025-31691 · Websites & servers · Drupal · reported by mlhess@drupal.orgCritical 9.8
Missing Authorization vulnerability in Drupal OAuth2 Server allows Forceful Browsing.This issue affects OAuth2 Server: from 0.0.0 before 2.1.0.
- Product
- OAuth2 Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 beforeCVE-2025-31686 · Websites & servers · Drupal · reported by mlhess@drupal.orgHigh 8.1
Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
- Product
- Open Social
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 beforeCVE-2025-31685 · Websites & servers · Drupal · reported by mlhess@drupal.orgCritical 9.1
Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
- Product
- Open Social
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.This issue affects Authenticator Login: from 0.0.0 before 2.0.6.CVE-2025-31681 · Websites & servers · Drupal · reported by mlhess@drupal.orgCritical 9.8
Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.This issue affects Authenticator Login: from 0.0.0 before 2.0.6.
- Product
- Authenticator Login
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing.This issue affects AI (Artificial Intelligence): from 0.0.0 CVE-2025-31678 · Websites & servers · Drupal · reported by mlhess@drupal.orgHigh 8.2
Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing.This issue affects AI (Artificial Intelligence): from 0.0.0 before 1.0.3.
- Product
- AI (Artificial Intelligence)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2025Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 befoCVE-2025-31673 · Websites & servers · Drupal · reported by mlhess@drupal.orgMedium 4.6
Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3.
- Product
- Drupal core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025WeGIA is a Web manager for charitable institutions.CVE-2025-30367 · Other software · LabRedesCefetRJ · reported by GitHubCritical 10
WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.2.6 in the nextPage parameter of the /WeGIA/controle/control.php endpoint. This vulnerability allows attacker to manipulate SQL queries and access sensitive database information, such as table names and sensitive data. Version 3.2.6 contains a fix for the issue.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025WeGIA is a Web manager for charitable institutions.CVE-2025-30366 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.2
WeGIA is a Web manager for charitable institutions. Versions prior to 3.2.8 are vulnerable to stored cross-site scripting. This vulnerability allows unauthorized scripts to be executed within the user's browser context. Stored XSS is particularly critical, as the malicious code is permanently stored on the server and executed whenever a compromised page is loaded, affecting all users accessing this page. Version 3.2.8 fixes the issue.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025WeGIA is a Web manager for charitable institutions.CVE-2025-30365 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.4
WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.2.8 in the endpoint /WeGIA/html/socio/sistema/controller/query_geracao_auto.php, specifically in the query parameter. This vulnerability allows the execution of arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. Version 3.2.8 fixes the issue.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025WeGIA is a Web manager for charitable institutions.CVE-2025-30364 · Other software · LabRedesCefetRJ · reported by GitHubCritical 10
WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.2.8 in the endpoint /WeGIA/html/funcionario/remuneracao.php, in the id_funcionario parameter. This vulnerability allows the execution of arbitrary SQL commands, which can compromise the confidentiality, integrity, and availability of stored data. Version 3.2.8 fixes the issue.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025WeGIA is a Web manager for charitable institutions.CVE-2025-30363 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is a Web manager for charitable institutions. A stored Cross-Site Scripting (XSS) vulnerability was identified in versions prior to 3.2.6. This vulnerability allows unauthorized scripts to be executed within the user's browser context. Stored XSS is particularly critical, as the malicious code is permanently stored on the server and executed whenever a compromised page is loaded, affecting all users accessing this page. Version 3.2.6 fixes the issue.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025WeGIA is a Web manager for charitable institutions.CVE-2025-30362 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is a Web manager for charitable institutions. A stored Cross-Site Scripting (XSS) vulnerability was identified in versions prior to 3.2.8. This vulnerability allows unauthorized scripts to be executed within the user's browser context. Stored XSS is particularly critical, as the malicious code is permanently stored on the server and executed whenever a compromised page is loaded, affecting all users accessing this page. Version 3.2.8 fixes the issue.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2025WeGIA is a Web manager for charitable institutions.CVE-2025-30361 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.3
WeGIA is a Web manager for charitable institutions. A security vulnerability was identified in versions prior to 3.2.6, where it is possible to change a user's password without verifying the old password. This issue exists in the control.php endpoint and allows unauthorized attackers to bypass authentication and authorization mechanisms to reset the password of any user, including admin accounts. Version 3.2.6 fixes the issue.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2025A Cross-Site Request Forgery (CSRF) vulnerability exists in the latest commit (56b782bcefd2e59b19cd7ba7878b95f54884f502) of the vanna-ai/vanna repository.CVE-2024-6841 · Other software · vanna-ai · reported by security@huntr.devMedium 6.5
A Cross-Site Request Forgery (CSRF) vulnerability exists in the latest commit (56b782bcefd2e59b19cd7ba7878b95f54884f502) of the vanna-ai/vanna repository. Two endpoints in the built-in web app that provide SQL functionality are implemented as simple GET requests, making them susceptible to CSRF attacks. This vulnerability allows an attacker to run arbitrary SQL commands via CSRF without the target intending to expose the web app to the network or other users. The impact is limited to data alteration or deletion, as the attacker cannot read the results of the query.
- Product
- vanna-ai/vanna
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 14, 2025WeGIA is Web manager for charitable institutions A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_tipo_docs_atendido.php` endpCVE-2025-29782 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is Web manager for charitable institutions A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_tipo_docs_atendido.php` endpoint in versions of the WeGIA application prior to 3.2.17. This vulnerability allows attackers to inject malicious scripts into the `tipo` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. Version 3.2.17 contains a patch for the issue.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.CVE-2025-27499 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the processa_edicao_socio.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the socio_nome parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. This vulnerability is fixed in 3.2.10.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.CVE-2025-27420 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the atendido_parentesco_adicionar.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the descricao parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. This vulnerability fix in 3.2.16.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.CVE-2025-27419 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.2
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Denial of Service (DoS) vulnerability exists in WeGIA. This vulnerability allows any unauthenticated user to cause the server to become unresponsive by performing aggressive spidering. The vulnerability is caused by recursive crawling of dynamically generated URLs and insufficient handling of large volumes of requests. This vulnerability is fixed in 3.2.16.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.CVE-2025-27418 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the adicionar_tipo_atendido.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the tipo parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. This vulnerability is fixed in 3.2.16.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.CVE-2025-27417 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the adicionar_status_atendido.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the status parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. This vulnerability is fixed in 3.2.16.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2025WeGIA is a Web manager for charitable institutions.CVE-2025-27140 · Other software · LabRedesCefetRJ · reported by GitHubCritical 10
WeGIA is a Web manager for charitable institutions. An OS Command Injection vulnerability was discovered in versions prior to 3.2.15 of the WeGIA application, `importar_dump.php` endpoint. This vulnerability could allow an attacker to execute arbitrary code remotely. The command is basically a command to move a temporary file, so a webshell upload is also possible. Version 3.2.15 contains a patch for the issue.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2025WeGIA is a Web manager for charitable institutions.CVE-2025-27133 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.4
WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was discovered in the WeGIA application prior to version 3.2.15 at the `adicionar_tipo_exame.php` endpoint. This vulnerability allows an authorized attacker to execute arbitrary SQL queries, allowing access to sensitive information. Version 3.2.15 contains a patch for the issue.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 20, 2025WeGIA is a Web Manager for Institutions with a focus on Portuguese language.CVE-2025-27096 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.4
WeGIA is a Web Manager for Institutions with a focus on Portuguese language. A SQL Injection vulnerability was discovered in the WeGIA application, personalizacao_upload.php endpoint. This vulnerability allow an authorized attacker to execute arbitrary SQL queries, allowing access to sensitive information. This issue has been addressed in version 3.2.14 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.CVE-2025-26617 · Other software · LabRedesCefetRJ · reported by GitHubCritical 10
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, `historico_paciente.php` endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing unauthorized access to sensitive information. This issue has been addressed in version 3.2.14 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.CVE-2025-26616 · Other software · LabRedesCefetRJ · reported by GitHubCritical 10
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Path Traversal vulnerability was discovered in the WeGIA application, `exportar_dump.php` endpoint. This vulnerability could allow an attacker to gain unauthorized access to sensitive information stored in `config.php`. `config.php` contains information that could allow direct access to the database. This issue has been addressed in version 3.2.14 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.CVE-2025-26615 · Other software · LabRedesCefetRJ · reported by GitHubCritical 10
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Path Traversal vulnerability was discovered in the WeGIA application, `examples.php` endpoint. This vulnerability could allow an attacker to gain unauthorized access to sensitive information stored in `config.php`. `config.php` contains information that could allow direct access to the database. This issue has been addressed in version 3.2.14 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.CVE-2025-26614 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.4
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, `deletar_documento.php` endpoint. This vulnerability allow an authorized attacker to execute arbitrary SQL queries, allowing access to sensitive information. This issue has been addressed in version 3.2.14 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.CVE-2025-26613 · Other software · LabRedesCefetRJ · reported by GitHubCritical 10
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. An OS Command Injection vulnerability was discovered in the WeGIA application, `gerenciar_backup.php` endpoint. This vulnerability could allow an attacker to execute arbitrary code remotely. This issue has been addressed in version 3.2.14 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2025WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.CVE-2025-26612 · Other software · LabRedesCefetRJ · reported by GitHubCritical 10
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, `adicionar_almoxarife.php` endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing unauthorized access to sensitive information. This issue has been addressed in version 3.2.13 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.