Labredescefetrj Wegia vulnerabilities

CVE-2025-53530 [HIGH] CWE-770 CVE-2025-53530: WeGIA is a web manager for charitable institutions. The Wegia server has a vulnerability that allows WeGIA is a web manager for charitable institutions. The Wegia server has a vulnerability that allows excessively long HTTP GET requests to a specific URL. This issue arises from the lack of validation for the length of the errorstr parameter. Tests confirmed that the server processes URLs up to 8,142 characters, resulting in high resource consumption,

CVE-2026-42871 [MEDIUM] CWE-200 CVE-2026-42871: WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, atendido/familiar_do WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, atendido/familiar_docfamiliar.php displays an overly descriptive error message, including database-related details. This verbosity leads to information disclosure, which could assist a potential attacker in mapping the backend infrastructure and expanding the attack surf

CVE-2026-40283 [HIGH] CWE-79 CVE-2026-40283: WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript via the "Nome" field in the "Informações Pacientes" page. The payload is stored and executed when the patient information is viewed. Version 3.6.10 fixes the issue

CVE-2026-42870 [MEDIUM] CWE-79 CVE-2026-42870: WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a Stored Cross-Site WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a Stored Cross-Site Scripting (XSS) flaw was identified at the following endpoint: funcionario/profile_funcionario.php?id_funcionario=2. By injecting a malicious payload into the 'Description' (Descrição) field and saving the profile, the script becomes persistently stored

CVE-2026-40282 [MEDIUM] CWE-79 CVE-2026-40282: WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript into the Intercorrências notification page, which is executed when user access the the page, enabling session hijacking and account takeover. Version 3.6.10 fixe

CVE-2025-57764 [HIGH] CWE-79 CVE-2025-57764: WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, a Reflected Cross-Site Scripting WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the cargos.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_e parameter. This vulnerability is fixed in 3.4.7.

CVE-2025-57765 [HIGH] CWE-79 CVE-2025-57765: WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, a Reflected Cross-Site Scripting WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the pre_cadastro_adotante.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_e parameter. This vulnerability is fixed in 3.4.7.

CVE-2026-45027 [MEDIUM] CWE-759 CVE-2026-45027: WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, when a user logs in, WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, when a user logs in, html/login.php hashes the submitted password using PHP's hash() function with the SHA-256 algorithm and no salt before comparing it to the stored value. The password change flow in controle/FuncionarioControle.php follows the same pattern. SHA-256 is

CVE-2026-40284 [MEDIUM] CWE-79 CVE-2026-40284: WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript via the "Destinatário" field. The payload is stored and later executed when viewing the dispatch page, impacting other users. Version 3.6.10 fixes the issue.

CVE-2025-55170 [HIGH] CWE-79 CVE-2025-55170: WeGIA is an open source web manager with a focus on the Portuguese language and charitable instituti WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a reflected cross-site scripting (XSS) vulnerability was identified in the /html/alterar_senha.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the verificacao and redi

CVE-2026-45026 [MEDIUM] CWE-79 CVE-2026-45026: WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, a Stored Cross-Site WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript into the Processo de Aceitação (html/atendido/processo_aceitacao.php) page, which is executed when user access the the page, enabling session hijacking and account

CVE-2026-45025 [MEDIUM] CWE-79 CVE-2026-45025: WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, a Stored Cross-Site WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript into the "Etapas de um Processo" (html/atendido/etapa_processo.php) page, which is executed when user access the the page, enabling session hijacking and account t

CVE-2026-35472 [MEDIUM] CWE-601 CVE-2026-35472: WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability w WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarTodos and nomeClasse=EstoqueControle. The application fails to validate or restrict the nex

CVE-2026-35396 [MEDIUM] CWE-601 CVE-2026-35396: WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability w WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarId and nomeClasse=IsaidaControle. The application fails to validate or restrict the nextPag

CVE-2026-35398 [MEDIUM] CWE-601 CVE-2026-35398: WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability w WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarTodos & listarId_Nome and nomeClasse=OrigemControle. The application fails to validate or r

CVE-2026-35473 [MEDIUM] CWE-601 CVE-2026-35473: WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability w WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarId and nomeClasse=IentradaControle. The application fails to validate or restrict the nextP

CVE-2026-45335 [MEDIUM] CWE-601 CVE-2026-45335: WeGIA is a web manager for charitable institutions. Prior to 3.7.3, an Open Redirect vulnerability w WeGIA is a web manager for charitable institutions. Prior to 3.7.3, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarTodos and nomeClasse=InternoControle. The application fails to validate or restrict the nex

CVE-2026-35399 [MEDIUM] CWE-79 CVE-2026-35399: WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, a stored XSS vulnerability allow WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, a stored XSS vulnerability allows an attacker to inject malicious scripts through a backup filename. This could lead to unauthorized execution of malicious code in the victim's browser, compromising session data or executing actions on behalf of the user. This vulnerability is fixed

CVE-2026-23729 [MEDIUM] CWE-601 CVE-2026-23729: WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an Open Redirect vulnerability w WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarDescricao and nomeClasse=ProdutoControle. The application fails to validate or restrict the

CVE-2026-23726 [MEDIUM] CWE-601 CVE-2026-23726: WeGIA is a web manager for charitable institutions. Prior to 3.6.2, An Open Redirect vulnerability w WeGIA is a web manager for charitable institutions. Prior to 3.6.2, An Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarTodos and nomeClasse=TipoEntradaControle. The application fails to validate or restrict the