Labredescefetrj Wegia vulnerabilities

CVE-2026-23728 [MEDIUM] CWE-601 CVE-2026-23728: WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an Open Redirect vulnerability w WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarTodos and nomeClasse=DestinoControle. The application fails to validate or restrict the nex

CVE-2026-23730 [MEDIUM] CWE-601 CVE-2026-23730: WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an Open Redirect vulnerability w WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarTodos and nomeClasse=ProdutoControle. The application fails to validate or restrict the nex

CVE-2026-23727 [MEDIUM] CWE-601 CVE-2026-23727: WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an Open Redirect vulnerability w WeGIA is a web manager for charitable institutions. Prior to 3.6.2, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarTodos and nomeClasse=TipoSaidaControle. The application fails to validate or restrict the n

CVE-2025-61604 [HIGH] CWE-352 CVE-2025-61604: WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and bel WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Cross-Site Request Forgery (CSRF) vulnerability. The delete operation for the Almoxarifado entity is exposed via HTTP GET without CSRF protection, allowing a third-party site to trigger the action using the victim’s authenticated session. T

CVE-2025-22596 [MEDIUM] CWE-79 CVE-2025-22596: WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerabi WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the modulos_visiveis.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_c parameter. This vulnerability is fixed in 3.2.8.

CVE-2026-35475 [MEDIUM] CWE-601 CVE-2026-35475: WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, the redirect parameter is taken WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, the redirect parameter is taken directly from $_GET with no URL validation or whitelist check, then used verbatim in a header("Location: ...") call. This vulnerability is fixed in 3.6.9.

CVE-2025-53821 [MEDIUM] CWE-601 CVE-2025-53821: WeGIA is an open source web manager with a focus on the Portuguese language and charitable instituti WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. An Open Redirect vulnerability exists in the web application prior to version 3.4.5. The control.php endpoint allows to specify an arbitrary URL via the `nextPage` parameter, leading to an uncontrolled redirection. Version 3.4.5 contains a fix fo

CVE-2025-24020 [MEDIUM] CWE-601 CVE-2025-24020: WeGIA is a Web manager for charitable institutions. An Open Redirect vulnerability was identified in WeGIA is a Web manager for charitable institutions. An Open Redirect vulnerability was identified in the `control.php` endpoint of versions up to and including 3.2.10 of the WeGIA application. The vulnerability allows the `nextPage` parameter to be manipulated, redirecting authenticated users to arbitrary external URLs without validation. The issue

CVE-2026-35474 [MEDIUM] CWE-601 CVE-2026-35474: WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, open redirect has been found in WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, open redirect has been found in WeGIA webapp. The redirect parameter is taken directly from $_GET with no URL validation or whitelist check, then used verbatim in a header("Location: ...") call. This vulnerability is fixed in 3.6.9.

CVE-2025-62361 [MEDIUM] CWE-601 CVE-2025-62361: WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prio WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.0, an Open Redirect vulnerability was identified in the control.php endpoint of the WeGIA application, specifically in the nextPage parameter (metodo=listarTodos nomeClasse=AlmoxarifeControle). This vulnerability allows attackers to redirect

CVE-2025-61606 [MEDIUM] CWE-601 CVE-2025-61606: WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and bel WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an Open Redirect vulnerability, identified in the control.php endpoint, specifically in the nextPage parameter (metodo=listarUmnomeClasse=FuncionarioControle). This vulnerability allows attackers to redirect users to arbitrary external doma

CVE-2025-30363 [MEDIUM] CWE-79 CVE-2025-30363: WeGIA is a Web manager for charitable institutions. A stored Cross-Site Scripting (XSS) vulnerabilit WeGIA is a Web manager for charitable institutions. A stored Cross-Site Scripting (XSS) vulnerability was identified in versions prior to 3.2.6. This vulnerability allows unauthorized scripts to be executed within the user's browser context. Stored XSS is particularly critical, as the malicious code is permanently stored on the server and executed wh

CVE-2026-33135 [MEDIUM] CWE-79 CVE-2026-33135: WeGIA is a web manager for charitable institutions. Versions 3.6.6 and below have a Reflected Cross- WeGIA is a web manager for charitable institutions. Versions 3.6.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability in the novo_memorandoo.php endpoint. An attacker can inject arbitrary JavaScript into the sccs GET parameter, which is directly echoed into the HTML response without any sanitization or encoding. The script /html/memo

CVE-2026-33136 [MEDIUM] CWE-79 CVE-2026-33136: WeGIA is a web manager for charitable institutions. Versions 3.6.6 and below have a Reflected Cross- WeGIA is a web manager for charitable institutions. Versions 3.6.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability in the listar_memorandos_ativos.php endpoint. An attacker can inject arbitrary JavaScript or HTML tags into the sccd GET parameter, which is then directly echoed into the HTML response without any sanitization or enco

CVE-2026-42872 [MEDIUM] CWE-79 CVE-2026-42872: WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a reflected Cross-Si WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a reflected Cross-Site Scripting (XSS) vulnerability exists in lista_arquivos_etapa.php due to improper handling of user-supplied input. The id_processo parameter is directly embedded into the HTML without sanitization, allowing attackers to inject arbitrary JavaScript. T

CVE-2026-23722 [MEDIUM] CWE-79 CVE-2026-23722: WeGIA is a Web Manager for Charitable Institutions. Prior to 3.6.2, a Reflected Cross-Site Scripting WeGIA is a Web Manager for Charitable Institutions. Prior to 3.6.2, a Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the WeGIA system, specifically within the html/memorando/insere_despacho.php file. The application fails to properly sanitize or encode user-supplied input via the id_memorando GET parameter before reflecting it i

CVE-2025-30362 [MEDIUM] CWE-79 CVE-2025-30362: WeGIA is a Web manager for charitable institutions. A stored Cross-Site Scripting (XSS) vulnerabilit WeGIA is a Web manager for charitable institutions. A stored Cross-Site Scripting (XSS) vulnerability was identified in versions prior to 3.2.8. This vulnerability allows unauthorized scripts to be executed within the user's browser context. Stored XSS is particularly critical, as the malicious code is permanently stored on the server and executed wh

CVE-2025-53526 [MEDIUM] CWE-79 CVE-2025-53526: WeGIA is a web manager for charitable institutions. An XSS Injection vulnerability was identified in WeGIA is a web manager for charitable institutions. An XSS Injection vulnerability was identified in novo_memorando.php. After the memo was submitted, the vulnerability was confirmed by accessing listar_memorandos_antigos.php. Upon loading this page, the injected script was executed in the browser. This vulnerability is fixed in 3.4.3.

CVE-2025-57762 [MEDIUM] CWE-79 CVE-2025-57762: WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, there is a Stored Cross-Site Scr WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, there is a Stored Cross-Site Scripting (XSS) vulnerability in the dependente_docdependente.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the nome parameter. The injected scripts are stored on the server and executed automa

CVE-2025-29782 [MEDIUM] CWE-79 CVE-2025-29782: WeGIA is Web manager for charitable institutions A Stored Cross-Site Scripting (XSS) vulnerability w WeGIA is Web manager for charitable institutions A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_tipo_docs_atendido.php` endpoint in versions of the WeGIA application prior to 3.2.17. This vulnerability allows attackers to inject malicious scripts into the `tipo` parameter. The injected scripts are stored on the ser