Labredescefetrj Wegia vulnerabilities

CVE-2025-24906 [CRITICAL] CWE-89 CVE-2025-24906: WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_detalhes_cobranca.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information. This issue has been addressed in version 3.2.

CVE-2025-26610 [CRITICAL] CWE-89 CVE-2025-26610: WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQ WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, `restaurar_produto_desocultar.php` endpoint. This vulnerability allow an authorized attacker to execute arbitrary SQL queries, allowing access to sensitive information. This issue has

CVE-2025-24905 [CRITICAL] CWE-89 CVE-2025-24905: WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_codigobarras_cobranca.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information. This issue has been addressed in version

CVE-2025-26609 [CRITICAL] CWE-89 CVE-2025-26609: WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQ WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, `familiar_docfamiliar.php` endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing unauthorized access to sensitive information. This issue has

CVE-2025-26617 [CRITICAL] CWE-89 CVE-2025-26617: WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQ WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, `historico_paciente.php` endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing unauthorized access to sensitive information. This issue has b

CVE-2025-30367 [CRITICAL] CWE-89 CVE-2025-30367: WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.2.6 in the nextPage parameter of the /WeGIA/controle/control.php endpoint. This vulnerability allows attacker to manipulate SQL queries and access sensitive database information, such as table names and sensitive data. Version 3.2.

CVE-2025-62177 [HIGH] CWE-89 CVE-2025-62177: WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prio WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.1, a SQL Injection vulnerability was identified in the /html/funcionario/dependente_listar.php endpoint, specifically in the id_funcionario parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confid

CVE-2026-31895 [HIGH] CWE-89 CVE-2026-31895: WeGIA is a web manager for charitable institutions. Prior to version 3.6.6, WeGIA (Web gerenciador p WeGIA is a web manager for charitable institutions. Prior to version 3.6.6, WeGIA (Web gerenciador para instituições assistenciais) contains a SQL injection vulnerability in html/matPat/restaurar_produto.php. The id_produto parameter from $_GET is directly interpolated into SQL queries without parameterization or sanitization. This vulnerability is fix

CVE-2025-62179 [HIGH] CWE-89 CVE-2025-62179: WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prio WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.1, a SQL Injection vulnerability was identified in the /html/funcionario/cadastro_funcionario_pessoa_existente.php endpoint, specifically in the cpf parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising t

CVE-2026-33991 [HIGH] CWE-89 CVE-2026-33991: WeGIA is a web manager for charitable institutions. Prior to version 3.6.7, the file `html/socio/sis WeGIA is a web manager for charitable institutions. Prior to version 3.6.7, the file `html/socio/sistema/deletar_tag.php` uses `extract($_REQUEST)` on line 14 and directly concatenates the `$id_tag` variable into SQL queries on lines 16-17 without prepared statements or sanitization. Version 3.6.7 patches the vulnerability.

CVE-2025-57761 [HIGH] CWE-89 CVE-2025-57761: WeGIA is a Web manager for charitable institutions. Prior to 3.4.10, there is a SQL Injection vulner WeGIA is a Web manager for charitable institutions. Prior to 3.4.10, there is a SQL Injection vulnerability in the /html/funcionario/dependente_remover.php endpoint, specifically in the id_funcionario parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the da

CVE-2025-54079 [HIGH] CWE-89 CVE-2025-54079: WeGIA is an open source web manager with a focus on the Portuguese language and charitable instituti WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.4.6 in the endpoint `/html/atendido/Profile_Atendido.php`, in the `idatendido` parameter. This vulnerability allow an authorized attacker to execute arbitrary SQL queries, allowing

CVE-2025-27133 [HIGH] CWE-89 CVE-2025-27133: WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was discovered in WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was discovered in the WeGIA application prior to version 3.2.15 at the `adicionar_tipo_exame.php` endpoint. This vulnerability allows an authorized attacker to execute arbitrary SQL queries, allowing access to sensitive information. Version 3.2.15 contains a patch for the

CVE-2025-24902 [HIGH] CWE-89 CVE-2025-24902: WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `salvar_cargo.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all us

CVE-2025-26614 [HIGH] CWE-89 CVE-2025-26614: WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQ WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, `deletar_documento.php` endpoint. This vulnerability allow an authorized attacker to execute arbitrary SQL queries, allowing access to sensitive information. This issue has been addressed

CVE-2025-24958 [HIGH] CWE-89 CVE-2025-24958: WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `salvar_tag.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all user

CVE-2025-24901 [HIGH] CWE-89 CVE-2025-24901: WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `deletar_permissao.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information. This issue has been addressed in version 3.2.12 and a

CVE-2025-26605 [HIGH] CWE-89 CVE-2025-26605: WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQ WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, `deletar_cargo.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to sensitive information. This issue has been address

CVE-2025-54058 [HIGH] CWE-89 CVE-2025-54058: WeGIA is an open source web manager with a focus on the Portuguese language and charitable instituti WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.4.6 in the `idatendido_familiares` parameter of the `/html/funcionario/dependente_editarEndereco.php` endpoint. This vulnerability allows attacker to manipulate SQL queries and acce

CVE-2025-54061 [HIGH] CWE-89 CVE-2025-54061: WeGIA is an open source web manager with a focus on the Portuguese language and charitable instituti WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.4.6 in the `idatendido_familiares` parameter of the `/html/funcionario/dependente_editarDoc.php` endpoint. This vulnerability allows attacker to manipulate SQL queries and access se