Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
205 results · page 1 of 5
Oct 14, 2026WeGIA is a web manager for charitable institutions.CVE-2026-55684 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.8
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint accepts form-encoded POST data through extract($_REQUEST) and interpolates codigo, descricao, data_emissao, data_vencimento, data_pagamento, valor, valor_pago, status, link_cobranca, link_boleto, linha_digitavel, and id_socio into a raw INSERT statement. Numeric parameters are unquoted and unvalidated, while string parameters can break out of their single-quoted SQL context. A remote attacker can execute arbitrary SQL to read or modify billing, member, employee, permission, and credential data or to delete database tables. This issue is fixed in version 3.8.6.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026WeGIA is a web manager for charitable institutions.CVE-2026-55683 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.8
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastro_cobranca.php endpoint accepts POST input through extract($_REQUEST) and directly incorporates valor, valor_pago, id_pessoa, id_socio, and id_sociotipo into UPDATE, INSERT, and SELECT statements without prepared statements. A remote attacker can use the affected parameters to execute arbitrary SQL that reads or modifies WeGIA database content, including billing records and credential data. The same SQL access can delete or truncate tables, causing loss of application data. This issue is fixed in version 3.8.6.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026WeGIA is a web manager for charitable institutions.CVE-2026-55682 · Other software · LabRedesCefetRJ · reported by GitHubHigh 8.1
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the auto-prepended web/html/seguranca/sessionStart.php reflects an attacker-supplied PHPSESSID cookie in a Set-Cookie response and uses DB_HOST as the cookie domain. If a victim authenticates while using the attacker-selected identifier, the attacker can reuse that identifier to hijack the authenticated session. The response also discloses the internal database host name through the cookie Domain attribute, and the vulnerable session handler affects all PHP pages. This issue is fixed in version 3.8.6.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026WeGIA is a web manager for charitable institutions.CVE-2026-55681 · Other software · LabRedesCefetRJ · reported by GitHubHigh 8.8
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, an authenticated user with access to the Material & Patrimônio module can submit id_produto to web/html/matPat/restaurar_produto_desocultar.php, where a second extract($_REQUEST) overwrites the value previously sanitized by intval(). The raw value is interpolated into UPDATE statements for the produto, isaida, and ientrada tables. An attacker can execute arbitrary SQL to extract sensitive database records or modify institutional and inventory data. This issue is fixed in version 3.8.6.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026WeGIA is a web manager for charitable institutions.CVE-2026-55680 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.8
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, unauthenticated POST requests to web/html/socio/sistema/cadastro_cobranca.php can place a quoted SQL expression in the codigo parameter, which extract($_REQUEST) passes into the WHERE codigo= clause of an UPDATE statement without validation or parameter binding. Quoting the value bypasses MariaDB type conversion for the VARCHAR column and permits arbitrary SQL execution without a session. An attacker can read or modify database content, including user credential hashes and billing records in the cobrancas table. This issue is fixed in version 3.8.6.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026WeGIA is a web manager for charitable institutions.CVE-2026-55679 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.5
WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command executed by shell_exec(). The installer also writes attacker-controlled values into executable config.php and concatenates the database name nomebd into a CREATE DATABASE statement. Successful exploitation can execute commands as the web-server user, persist attacker-controlled PHP configuration, and alter or disrupt the application and its data. This issue is fixed in version 3.8.6.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip.CVE-2026-75907 · Other software · Norwegian Cruise Line · reported by cret@cert.orgHigh 7.5
The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is a manufacturer serial number sent in the clear on every read and is not intended to be secret or to authenticate the holder. Validating on the UID of the NTAG212 NFC chip alone is identification, not authentication, and the credential has no challenge-response capability that would resist copying.
- Product
- door access control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgkb.cert.org
Sep 17, 2026WeGIA is a web manager for charitable institutions.CVE-2026-54767 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.1
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, web/html/socio/sistema/controller/deletar_socios.php exposes an unauthenticated GET endpoint whose chave parameter is checked only against a hardcoded chave_correta value embedded in the public source repository. A remote attacker who obtains that value can reach the endpoint's TRUNCATE TABLE operations for the endereco, pessoafisica, pessoajuridica, and socio tables without an administrative session or application authorization, permanently destroying member and contributor records. The attack requires the affected tables to exist and the web process database account to possess truncation privileges. This issue is fixed in version 3.8.5.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026WeGIA is a web manager for charitable institutions.CVE-2026-54671 · Other software · LabRedesCefetRJ · reported by GitHubHigh 8.8
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php treats that empty array as unconditional access for every authenticated user. The methods in web/controle/InternoControle.php, including listarUm, alterar, and excluir, accept user-controlled id or idInterno values without verifying ownership, allowing a low-privileged user to read, modify, or delete another person's records and expose personal, identity, address, medical, and family information. The advisory notes that a self-referencing load bug can crash this controller in the reported revision, but the empty-resource authorization pattern and affected methods remain the vulnerability under review. This issue is fixed in version 3.8.5.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 17, 2026WeGIA is a web manager for charitable institutions.CVE-2026-54670 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.1
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, the contribution request dispatcher in web/html/contribuicao/controller/control.php accepts attacker-controlled nomeClasse and metodo values without a complete controller and method allowlist, exempts sensitive ContribuicaoLogController operations from authentication, and constructs a controller include path without canonical directory containment. An unauthenticated remote attacker can invoke getContribuicoesLogJSON, sincronizarStatus, registrarFaturas, and other sensitive methods to disclose contribution and donation records or trigger financial workflow operations. A traversal-shaped nomeClasse value can also cause require_once to include an accessible PHP or configuration file outside the intended controller directory, exposing source code, credentials, or other sensitive local data. This issue is fixed in version 3.8.5.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitraCVE-2026-76634 · Other software · LabRedesCefetRJ · reported by VulnCheckHigh 7.1
WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an id_pessoa parameter through a request extraction function that overwrites the session-derived identifier. Attackers can enumerate all user identifiers to retrieve full profile data for any employee account, including name, CPF, address, contact details, and administrative flags.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 20, 2026WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account passworCVE-2026-76633 · Other software · LabRedesCefetRJ · reported by VulnCheckHigh 8.6
WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of the alterarSenha method from permission checks in controle/control.php. Attackers can manipulate the redir parameter to point to alterar_senha.php, routing through verificarSenhaConfig() instead of verificarSenha() to bypass current password verification and convert temporary session access into permanent account takeover.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026WeGIA is a web manager for charitable institutions.CVE-2026-45335 · Other software · LabRedesCefetRJ · reported by GitHubMedium 5.4
WeGIA is a web manager for charitable institutions. Prior to 3.7.3, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarTodos and nomeClasse=InternoControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain. This vulnerability is fixed in 3.7.3.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 27, 2026WeGIA is a web manager for charitable institutions.CVE-2026-45027 · Other software · LabRedesCefetRJ · reported by GitHubMedium 5.9
WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, when a user logs in, html/login.php hashes the submitted password using PHP's hash() function with the SHA-256 algorithm and no salt before comparing it to the stored value. The password change flow in controle/FuncionarioControle.php follows the same pattern. SHA-256 is a general-purpose cryptographic hash built for speed, not password storage. Without a salt, identical passwords produce identical digests, making the entire hash database vulnerable to a single precomputed rainbow table lookup. This vulnerability is fixed in 3.7.3.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026WeGIA is a web manager for charitable institutions.CVE-2026-45026 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.8
WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript into the Processo de Aceitação (html/atendido/processo_aceitacao.php) page, which is executed when user access the the page, enabling session hijacking and account takeover. This vulnerability is fixed in 3.7.3.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026WeGIA is a web manager for charitable institutions.CVE-2026-45025 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.8
WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript into the "Etapas de um Processo" (html/atendido/etapa_processo.php) page, which is executed when user access the the page, enabling session hijacking and account takeover. This vulnerability is fixed in 3.7.3.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026WeGIA is a web manager for charitable institutions.CVE-2026-42873 · Other software · LabRedesCefetRJ · reported by GitHubNone
WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, when attempting to upload a file with malicious content to funcionario/docdependente_upload.php, the application responds with an overly descriptive error message. This leads to information disclosure, effectively increasing the attack surface by providing potential attackers with technical insights to refine their exploits. This vulnerability is fixed in 3.6.10.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026WeGIA is a web manager for charitable institutions.CVE-2026-42872 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.1
WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a reflected Cross-Site Scripting (XSS) vulnerability exists in lista_arquivos_etapa.php due to improper handling of user-supplied input. The id_processo parameter is directly embedded into the HTML without sanitization, allowing attackers to inject arbitrary JavaScript. This can lead to session hijacking, credential theft, or execution of malicious actions in the context of the victim's browser. This vulnerability is fixed in 3.7.0.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026WeGIA is a web manager for charitable institutions.CVE-2026-42870 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a Stored Cross-Site Scripting (XSS) flaw was identified at the following endpoint: funcionario/profile_funcionario.php?id_funcionario=2. By injecting a malicious payload into the 'Description' (Descrição) field and saving the profile, the script becomes persistently stored. The payload is subsequently executed whenever the profile page is accessed. This vulnerability is fixed in 3.7.0.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2026WeGIA is a web manager for charitable institutions.CVE-2026-42871 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.9
WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, atendido/familiar_docfamiliar.php displays an overly descriptive error message, including database-related details. This verbosity leads to information disclosure, which could assist a potential attacker in mapping the backend infrastructure and expanding the attack surface. This vulnerability is fixed in 3.7.0.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026WeGIA is a web manager for charitable institutions.CVE-2026-40286 · Other software · LabRedesCefetRJ · reported by GitHubHigh 7.5
WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the 'Member Registration' (Cadastrar Sócio) function. By injecting a payload into the 'Member Name' (Nome Sócio) field, the script is persistently stored in the database. Consequently, the payload is executed whenever a user navigates to certain URL. Version 3.6.10 fixes the issue.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026WeGIA is a web manager for charitable institutions.CVE-2026-40285 · Other software · LabRedesCefetRJ · reported by GitHubHigh 8.8
WeGIA is a web manager for charitable institutions. Versions prior to 3.6.10 contain a SQL injection vulnerability in dao/memorando/UsuarioDAO.php. The cpf_usuario POST parameter overwrites the session-stored user identity via extract($_REQUEST) in DespachoControle::verificarDespacho(), and the attacker-controlled value is then interpolated directly into a raw SQL query, allowing any authenticated user to query the database under an arbitrary identity. Version 3.6.10 fixes the issue.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026WeGIA is a web manager for charitable institutions.CVE-2026-40284 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.8
WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript via the "Destinatário" field. The payload is stored and later executed when viewing the dispatch page, impacting other users. Version 3.6.10 fixes the issue.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026WeGIA is a web manager for charitable institutions.CVE-2026-40282 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.4
WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript into the Intercorrências notification page, which is executed when user access the the page, enabling session hijacking and account takeover. Version 3.6.10 fixes the issue.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026WeGIA is a web manager for charitable institutions.CVE-2026-40283 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.8
WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript via the "Nome" field in the "Informações Pacientes" page. The payload is stored and executed when the patient information is viewed. Version 3.6.10 fixes the issue.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026WeGIA is a Web manager for charitable institutions.CVE-2026-35475 · Other software · LabRedesCefetRJ · reported by GitHubMedium 5.1
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, the redirect parameter is taken directly from $_GET with no URL validation or whitelist check, then used verbatim in a header("Location: ...") call. This vulnerability is fixed in 3.6.9.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026WeGIA is a Web manager for charitable institutions.CVE-2026-35474 · Other software · LabRedesCefetRJ · reported by GitHubMedium 5.1
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, open redirect has been found in WeGIA webapp. The redirect parameter is taken directly from $_GET with no URL validation or whitelist check, then used verbatim in a header("Location: ...") call. This vulnerability is fixed in 3.6.9.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026WeGIA is a Web manager for charitable institutions.CVE-2026-35473 · Other software · LabRedesCefetRJ · reported by GitHubMedium 5.1
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarId and nomeClasse=IentradaControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain. This vulnerability is fixed in 3.6.9.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026WeGIA is a Web manager for charitable institutions.CVE-2026-35472 · Other software · LabRedesCefetRJ · reported by GitHubMedium 5.1
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarTodos and nomeClasse=EstoqueControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain. This vulnerability is fixed in 3.6.9.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026WeGIA is a Web manager for charitable institutions.CVE-2026-35399 · Other software · LabRedesCefetRJ · reported by GitHubHigh 8.5
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, a stored XSS vulnerability allows an attacker to inject malicious scripts through a backup filename. This could lead to unauthorized execution of malicious code in the victim's browser, compromising session data or executing actions on behalf of the user. This vulnerability is fixed in 3.6.9.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026WeGIA is a Web manager for charitable institutions.CVE-2026-35398 · Other software · LabRedesCefetRJ · reported by GitHubMedium 5.1
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarTodos & listarId_Nome and nomeClasse=OrigemControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain. This vulnerability is fixed in 3.6.9.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026WeGIA is a Web manager for charitable institutions.CVE-2026-35396 · Other software · LabRedesCefetRJ · reported by GitHubMedium 5.1
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarId and nomeClasse=IsaidaControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain. This vulnerability is fixed in 3.6.9.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 6, 2026WeGIA is a Web manager for charitable institutions.CVE-2026-35395 · Other software · LabRedesCefetRJ · reported by GitHubHigh 8.8
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, WeGIA (Web gerenciador para instituições assistenciais) contains a SQL injection vulnerability in dao/memorando/DespachoDAO.php. The id_memorando parameter is extracted from $_REQUEST without validation and directly interpolated into SQL queries, allowing any authenticated user to execute arbitrary SQL commands against the database. This vulnerability is fixed in 3.6.9.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026WeGIA is a web manager for charitable institutions.CVE-2026-33991 · Other software · LabRedesCefetRJ · reported by GitHubHigh 8.8
WeGIA is a web manager for charitable institutions. Prior to version 3.6.7, the file `html/socio/sistema/deletar_tag.php` uses `extract($_REQUEST)` on line 14 and directly concatenates the `$id_tag` variable into SQL queries on lines 16-17 without prepared statements or sanitization. Version 3.6.7 patches the vulnerability.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026WeGIA is a web manager for charitable institutions.CVE-2026-33136 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.3
WeGIA is a web manager for charitable institutions. Versions 3.6.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability in the listar_memorandos_ativos.php endpoint. An attacker can inject arbitrary JavaScript or HTML tags into the sccd GET parameter, which is then directly echoed into the HTML response without any sanitization or encoding. The script /html/memorando/listar_memorandos_ativos.php handles dynamic success messages to users using query string parameters. Similar to other endpoints in the Memorando module, it checks if $_GET['msg'] equals 'success'. If this condition is met, it directly concatenates and reflects $_GET['sccd'] into an HTML alert <div>. This issue is resolved in version 3.6.7.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026WeGIA is a web manager for charitable institutions.CVE-2026-33135 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.3
WeGIA is a web manager for charitable institutions. Versions 3.6.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability in the novo_memorandoo.php endpoint. An attacker can inject arbitrary JavaScript into the sccs GET parameter, which is directly echoed into the HTML response without any sanitization or encoding. The script /html/memorando/novo_memorandoo.php reads HTTP GET parameters to display dynamic success messages to the user. At approximately line 273, the code checks if $_GET['msg'] equals 'success'. If true, it directly concatenates $_GET['sccs'] into an HTML alert <div> and outputs it to the browser. This issue has been fixed in version 3.6.7.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026WeGIA is a web manager for charitable institutions.CVE-2026-33134 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.3
WeGIA is a web manager for charitable institutions. Versions 3.6.5 and below contain an authenticated SQL Injection vulnerability in the html/matPat/restaurar_produto.php endpoint. The vulnerability allows an authenticated attacker to inject arbitrary SQL commands via the id_produto GET parameter, leading to full database compromise. In the script /html/matPat/restaurar_produto.php, the application retrieves the id_produto parameter directly from the $_GET global array and interpolates it directly into two SQL query strings without any sanitization, type-casting (e.g., (int)), or using parameterized (prepare/execute) statements. This issue has been fixed in version 3.6.6.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 20, 2026WeGIA is a web manager for charitable institutions.CVE-2026-33133 · Other software · LabRedesCefetRJ · reported by GitHubHigh 8.6
WeGIA is a web manager for charitable institutions. In versions 3.6.5 and 3.6.6, the loadBackupDB() function imports SQL files from uploaded backup archives without any content validation. An attacker can craft a backup archive containing arbitrary SQL statements that create rogue administrator accounts, modify existing passwords, or execute any database operation. This was introduced in commit 370104c. This issue was patched in version 3.6.7.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026WeGIA is a web manager for charitable institutions.CVE-2026-31896 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.8
WeGIA is a web manager for charitable institutions. Prior to version 3.6.6, a critical SQL injection vulnerability exists in the WeGIA application. The remover_produto_ocultar.php script uses extract($_REQUEST) to populate local variables and then directly concatenates these variables into a SQL query executed via PDO::query. This allows an authenticated (or auth-bypassed) attacker to execute arbitrary SQL commands. This can be used to exfiltrate sensitive data from the database or, as demonstrated in this PoC, cause a time-based delay (denial of service). This vulnerability is fixed in 3.6.6.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026WeGIA is a web manager for charitable institutions.CVE-2026-31895 · Other software · LabRedesCefetRJ · reported by GitHubHigh 8.8
WeGIA is a web manager for charitable institutions. Prior to version 3.6.6, WeGIA (Web gerenciador para instituições assistenciais) contains a SQL injection vulnerability in html/matPat/restaurar_produto.php. The id_produto parameter from $_GET is directly interpolated into SQL queries without parameterization or sanitization. This vulnerability is fixed in 3.6.6.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 11, 2026WeGIA is a web manager for charitable institutions.CVE-2026-31894 · Other software · LabRedesCefetRJ · reported by GitHubMedium 6.9
WeGIA is a web manager for charitable institutions. In 3.6.5, The patched loadBackupDB() extracts tar.gz archives to a temporary directory using PHP's PharData class, then uses glob() and file_get_contents() to read SQL files from the extracted contents. Neither the extraction nor the file reading validates whether archive members are symbolic links. This vulnerability is fixed in 3.6.6.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026WeGIA is a web manager for charitable institutions.CVE-2026-28411 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.8
WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, an unsafe use of the `extract()` function on the `$_REQUEST` superglobal allows an unauthenticated attacker to overwrite local variables in multiple PHP scripts. This vulnerability can be leveraged to completely bypass authentication checks, allowing unauthorized access to administrative and protected areas of the WeGIA application. Version 3.6.5 fixes the issue.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026WeGIA is a web manager for charitable institutions.CVE-2026-28409 · Other software · LabRedesCefetRJ · reported by GitHubCritical 10
WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, a critical Remote Code Execution (RCE) vulnerability exists in the WeGIA application's database restoration functionality. An attacker with administrative access (which can be obtained via the previously reported Authentication Bypass) can execute arbitrary OS commands on the server by uploading a backup file with a specifically crafted filename. Version 3.6.5 fixes the issue.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 27, 2026WeGIA is a web manager for charitable institutions.CVE-2026-28408 · Other software · LabRedesCefetRJ · reported by GitHubCritical 9.8
WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, the script in adicionar_tipo_docs_atendido.php does not go through the project's central controller and does not have its own authentication and permission checks. A malicious user could make a request through tools like Postman or the file's URL on the web to access features exclusive to employees. The vulnerability allows external parties to inject unauthorized data in massive quantities into the application server's storage. Version 3.6.5 fixes the issue.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2026WeGIA is a web manager for charitable institutions.CVE-2026-23731 · Other software · LabRedesCefetRJ · reported by GitHubMedium 4.3
WeGIA is a web manager for charitable institutions. Prior to 3.6.2, The web application is vulnerable to clickjacking attacks. The WeGIA application does not send any defensive HTTP headers related to framing protection. In particular, X-Frame-Options is missing andContent-Security-Policy with frame-ancestors directive is not configured. Because of this, an attacker can load any WeGIA page inside a malicious HTML document, overlay deceptive elements, hide real buttons, or force accidental interaction with sensitive workflows. This vulnerability is fixed in 3.6.2.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2026WeGIA is a web manager for charitable institutions.CVE-2026-23730 · Other software · LabRedesCefetRJ · reported by GitHubMedium 4.8
WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarTodos and nomeClasse=ProdutoControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain. This vulnerability is fixed in 3.6.2.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2026WeGIA is a web manager for charitable institutions.CVE-2026-23729 · Other software · LabRedesCefetRJ · reported by GitHubMedium 4.8
WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarDescricao and nomeClasse=ProdutoControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain. This vulnerability is fixed in 3.6.2.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2026WeGIA is a web manager for charitable institutions.CVE-2026-23728 · Other software · LabRedesCefetRJ · reported by GitHubMedium 4.8
WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarTodos and nomeClasse=DestinoControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain. This vulnerability is fixed in 3.6.2.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2026WeGIA is a web manager for charitable institutions.CVE-2026-23727 · Other software · LabRedesCefetRJ · reported by GitHubMedium 4.8
WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarTodos and nomeClasse=TipoSaidaControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain. This vulnerability is fixed in 3.6.2.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2026WeGIA is a web manager for charitable institutions.CVE-2026-23726 · Other software · LabRedesCefetRJ · reported by GitHubMedium 4.8
WeGIA is a web manager for charitable institutions. Prior to 3.6.2, An Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarTodos and nomeClasse=TipoEntradaControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain. This vulnerability is fixed in 3.6.2.
- Product
- WeGIA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.