Description Summary:
A stored cross-site scripting (XSS) vulnerability in the Member Registration function of WeGIA allows unauthenticated attackers to execute malicious scripts via the Member Name field.

Executive Summary:
A stored XSS vulnerability in WeGIA versions prior to 3.6.10 exposes the application to malicious script injection, potentially leading to unauthorized actions or session compromise.

Vulnerability Details

CVE-ID: CVE-2026-40286

Affected Software: LabRedesCefetRJ WeGIA

Affected Versions: < 3.6.10

Vulnerability: The application fails to properly sanitize user input within the Member Name (Nome Sócio) field. This allows an unauthenticated attacker to inject a script that is persistently stored in the database and executed when a user visits the affected URL.

Business Impact

The successful exploitation of this vulnerability allows for the execution of arbitrary scripts in the context of an unsuspecting user's session. This could lead to account takeover, unauthorized data modification, or the theft of sensitive institutional information. Given the CVSS score of 7.5, this represents a high-risk security flaw that necessitates immediate attention to maintain the integrity of charitable organization records.

Remediation Plan

Immediate Action: Upgrade the WeGIA installation to version 3.6.10 or later to ensure the input sanitization fix is applied.

Proactive Monitoring: Review application access and audit logs for suspicious activity or unexpected script execution patterns originating from the Member Registration module.

Compensating Controls: Implement a strict Content Security Policy (CSP) and utilize a Web Application Firewall (WAF) configured to filter common XSS payloads from input fields.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of April 20, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its stored nature, which allows the malicious payload to persist and affect multiple users over time.

Analyst Recommendation

The presence of this stored XSS vulnerability poses a significant risk to the security and privacy of the users of the WeGIA platform. Administrators must prioritize updating to version 3.6.10 immediately to eliminate this injection vector. Failure to patch allows persistent threats to remain active within the application database, potentially compromising organizational data integrity.

Description Summary:
WeGIA versions prior to 3.6.10 contain a SQL injection and authentication bypass vulnerability in the user dispatch control module, allowing authenticated users to perform unauthorized database queries.

Executive Summary:
A critical SQL injection vulnerability in WeGIA allows authenticated users to impersonate others and execute arbitrary database queries, posing a significant risk to data integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-40285

Affected Software: LabRedesCefetRJ WeGIA

Affected Versions: < 3.6.10

Vulnerability: The application utilizes an insecure extract($_REQUEST) call within DespachoControle::verificarDespacho(), which permits the overwriting of session-stored user identity. This attacker-controlled value is subsequently interpolated into raw SQL queries in dao/memorando/UsuarioDAO.php, enabling any authenticated user to perform unauthorized database operations.

Business Impact

Successful exploitation of this flaw allows an attacker to bypass intended access controls and execute arbitrary SQL commands against the underlying database. Given the CVSS score of 8.8, this vulnerability carries a high potential for unauthorized data exfiltration, manipulation of institutional records, and total compromise of the application data layer.

Remediation Plan

Immediate Action: Upgrade WeGIA to version 3.6.10 or later, which incorporates the necessary input sanitization and logic fixes to prevent request parameter injection.

Proactive Monitoring: Review application access logs for unusual patterns in the cpf_usuario parameter and monitor database audit logs for unauthorized or unexpected queries originating from authenticated users.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads and suspicious request parameter modifications.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 19, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability stems from improper handling of PHP superglobals, which is a high-risk programming pattern.

Analyst Recommendation

Due to the severity of this vulnerability and the potential for complete database compromise, organizations using WeGIA must prioritize the update to version 3.6.10. Administrators should verify the patch deployment immediately and conduct a review of database logs for any indicators of compromise occurring prior to the update.

Description Summary:
WeGIA, a web manager for charitable institutions, contains a SQL injection vulnerability in the id_memorando parameter within DespachoDAO.php, allowing arbitrary SQL command execution.

Executive Summary:
A critical SQL injection vulnerability in WeGIA versions prior to 3.6.9 allows authenticated users to execute arbitrary SQL commands, posing a significant risk to database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-35395

Affected Software: LabRedesCefetRJ WeGIA

Affected Versions: < 3.6.9

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the dao/memorando/DespachoDAO.php file. The application fails to sanitize the id_memorando parameter, which is taken from the request and directly interpolated into database queries by any authenticated user.

Business Impact

The ability to execute arbitrary SQL commands provides an attacker with complete control over the underlying database. This can lead to unauthorized data exfiltration, modification of sensitive institutional records, and potential system compromise. With a CVSS score of 8.8, this flaw represents a high-severity risk that requires immediate attention to prevent data breach and service disruption.

Remediation Plan

Immediate Action: Update the WeGIA software to version 3.6.9 or higher to apply the vendor-supplied security patch.

Proactive Monitoring: Review application access logs for unusual SQL syntax or unexpected database query patterns originating from authenticated user sessions.

Compensating Controls: Implement a Web Application Firewall (WAF) configured to detect and block SQL injection patterns to provide a temporary layer of protection while the update is being prepared.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 8, 2026, there is no public information indicating active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous due to the lack of input validation in a database-facing component.

Analyst Recommendation

Given the high CVSS score and the presence of a known proof-of-concept, administrators should prioritize patching this vulnerability immediately. Upgrading to version 3.6.9 is the only definitive way to remediate the flaw and protect the integrity of the institutional database.

Description Summary:
WeGIA is vulnerable to SQL injection via the deletar_tag.php script, allowing an authenticated attacker to execute arbitrary SQL commands due to improper input sanitization.

Executive Summary:
A critical SQL injection vulnerability in WeGIA versions prior to 3.6.7 allows authenticated attackers to manipulate backend database queries, posing a severe risk to data integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-33991

Affected Software: LabRedesCefetRJ WeGIA

Affected Versions: < 3.6.7

Vulnerability: The application suffers from an SQL injection flaw in the file html/socio/sistema/deletar_tag.php, where the use of extract($_REQUEST) combined with unsanitized concatenation of the id_tag variable into SQL queries allows an authenticated user to perform unauthorized database operations.

Business Impact

The exploitation of this vulnerability could lead to the complete compromise of the underlying database, including unauthorized data extraction, modification, or deletion. Given the CVSS score of 8.8, this flaw represents a high risk to the confidentiality, integrity, and availability of sensitive charitable institution records, potentially resulting in significant reputational damage and operational disruption.

Remediation Plan

Immediate Action: Update the WeGIA software installation to version 3.6.7 or later, which includes the necessary patch to remediate the SQL injection vulnerability.

Proactive Monitoring: Audit database access logs for unusual query patterns or unexpected commands originating from the deletar_tag.php endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting HTTP request parameters.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows direct manipulation of database queries via simple user-controlled input.

Analyst Recommendation

Organizations utilizing WeGIA must prioritize the upgrade to version 3.6.7 immediately to eliminate this injection vector. Failure to patch leaves the backend database exposed to unauthorized manipulation by any authenticated user, which could result in a total loss of data control.

Description Summary:
A Reflected XSS vulnerability in WeGIA's listar_memorandos_ativos.php endpoint allows attackers to inject malicious JavaScript via the sccd GET parameter.

Executive Summary:
Malicious scripts can be executed in a user's browser via a Reflected XSS vulnerability in the WeGIA active memorandum listing endpoint.

Vulnerability Details

CVE-ID: CVE-2026-33136

Affected Software: WeGIA

Affected Versions: Versions 3.6.6 and below

Vulnerability: This is a Reflected Cross-Site Scripting (XSS) vulnerability in the sccd GET parameter of the /html/memorando/listar_memorandos_ativos.php script. The application fails to sanitize or encode the parameter before reflecting it into an HTML alert component, enabling arbitrary script execution.

Business Impact

A successful exploit could allow an attacker to steal session cookies, redirect users to malicious websites, or capture sensitive information displayed on the page. Given the CVSS score of 9.3, the risk of administrative account compromise via this vector is significant, potentially leading to unauthorized institutional data access.

Remediation Plan

Immediate Action: Update WeGIA to version 3.6.7 or later. This version contains the necessary output encoding to mitigate XSS risks across the Memorando module.

Proactive Monitoring: Review web logs for requests to listar_memorandos_ativos.php that include HTML tags or JavaScript keywords in the query string.

Compensating Controls: Deploy a Web Application Firewall (WAF) to detect and block common XSS attack patterns in HTTP GET requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation. This vulnerability is very similar to CVE-2026-33135 and likely stems from the same insecure coding pattern.

Analyst Recommendation

The recurrence of XSS vulnerabilities in multiple endpoints suggests a systemic lack of input validation and output encoding. Administrators should apply the 3.6.7 update immediately and consider a comprehensive security code review of the entire WeGIA application to identify other similar flaws.

Description Summary:
WeGIA versions 3.6.6 and below are vulnerable to Reflected Cross-Site Scripting (XSS) in the novo_memorandoo.php endpoint, allowing arbitrary JavaScript execution in user browsers.

Executive Summary:
Attackers can execute malicious scripts in the context of a user's session by exploiting a Reflected XSS vulnerability in the WeGIA platform.

Vulnerability Details

CVE-ID: CVE-2026-33135

Affected Software: WeGIA

Affected Versions: Versions 3.6.6 and below

Vulnerability: A Reflected Cross-Site Scripting (XSS) vulnerability exists in the sccs GET parameter of the /html/memorando/novo_memorandoo.php endpoint. The application directly reflects the input into an HTML alert div without sanitization, allowing an attacker to inject arbitrary JavaScript.

Business Impact

Exploitation of this vulnerability can lead to session hijacking, credential theft (via phishing), and the performance of unauthorized actions on behalf of the victim. If an administrator is targeted, the attacker could gain full control over the WeGIA management interface. The CVSS score of 9.3 reflects the high potential for account takeover.

Remediation Plan

Immediate Action: Upgrade WeGIA to version 3.6.7 or later to ensure all dynamic success messages are properly encoded before being rendered.

Proactive Monitoring: Monitor web server logs for suspicious URL parameters containing <script> tags or other JavaScript event handlers.

Compensating Controls: Implement a strong Content Security Policy (CSP) to restrict the execution of inline scripts and prevent the loading of scripts from untrusted domains.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation. Reflected XSS requires an attacker to trick a user into clicking a specially crafted link.

Analyst Recommendation

While XSS is often viewed as less severe than RCE, in a management application like WeGIA, it can lead directly to administrative compromise. Apply the 3.6.7 patch immediately and educate users on the risks of clicking untrusted links.

Description Summary:
WeGIA versions 3.6.5 and below contain an authenticated SQL injection vulnerability in the restaurar_produto.php endpoint, potentially leading to full database compromise.

Executive Summary:
Authenticated attackers can execute arbitrary SQL commands to compromise the entire database of the WeGIA web manager.

Vulnerability Details

CVE-ID: CVE-2026-33134

Affected Software: WeGIA

Affected Versions: Versions 3.6.5 and below

Vulnerability: This is an authenticated SQL injection vulnerability in the id_produto GET parameter of the /html/matPat/restaurar_produto.php endpoint. The application fails to sanitize or parameterize the input before using it in SQL queries, allowing an attacker to manipulate database operations.

Business Impact

Successful exploitation allows an attacker to read, modify, or delete any data within the database. For a charitable institution manager, this could result in the theft of sensitive donor information, financial records, and institutional data. The CVSS score of 9.3 highlights the severe risk to data integrity and confidentiality.

Remediation Plan

Immediate Action: Upgrade WeGIA to version 3.6.6 or later, which implements parameterized statements to prevent SQL injection.

Proactive Monitoring: Review database logs for unusual query patterns and audit the restaurar_produto.php access logs for suspicious characters (e.g., single quotes, semicolons) in the URL.

Compensating Controls: Implement a Web Application Firewall (WAF) with SQL injection protection rules to filter malicious GET parameters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Mar 20, 2026, there is no public information indicating active exploitation. The vulnerability requires authentication, which slightly limits the attacker pool to those with valid user credentials.

Analyst Recommendation

SQL injection remains one of the most damaging web vulnerabilities. Administrators of WeGIA should prioritize the update to version 3.6.6 immediately. Additionally, ensure that the database user for the application follows the principle of least privilege to limit the impact of any potential injection.

Description Summary:
WeGIA versions 3.6.5 and 3.6.6 contain a critical SQL injection vulnerability in the loadBackupDB function, allowing attackers to execute arbitrary database commands via crafted backup archives.

Executive Summary:
LabRedesCefetRJ WeGIA versions 3.6.5 and 3.6.6 are vulnerable to SQL injection, which allows authenticated administrators to execute arbitrary database commands and potentially compromise the entire system.

Vulnerability Details

CVE-ID: CVE-2026-33133

Affected Software: LabRedesCefetRJ WeGIA

Affected Versions: >= 3.6.5, < 3.6.7

Vulnerability: The loadBackupDB function fails to perform content validation when importing SQL files from uploaded backup archives. This allows an authenticated administrator to inject malicious SQL statements to create rogue accounts, alter passwords, or perform unauthorized database operations.

Business Impact

Successful exploitation of this vulnerability permits full control over the application database. This could lead to a total loss of confidentiality, integrity, and availability of institutional data. Given the CVSS score of 7.2, the risk is significant, as it provides an attacker with the ability to manipulate administrative functions and compromise the underlying data infrastructure.

Remediation Plan

Immediate Action: Update the WeGIA installation to version 3.6.7 or later to implement the necessary input validation for backup imports.

Proactive Monitoring: Review database access logs for unexpected administrative account creation or unusual SQL commands originating from the backup restoration process.

Compensating Controls: Restrict access to the backup and restore functionality to trusted personnel only and monitor file upload directories for unauthorized or suspicious backup archives.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of validation in a privileged database import function, but it requires administrative access to the WeGIA management interface.

Analyst Recommendation

The risk posed by this SQL injection vulnerability necessitates immediate attention. Administrators must prioritize updating to version 3.6.7 to close the attack vector. Failure to patch allows any user with administrative privileges to gain full control over the database, leading to potential long-term data compromise.

Description Summary:
WeGIA contains a critical SQL injection vulnerability in the remover_produto_ocultar.php script due to improper handling of user-supplied request data.

Executive Summary:
A critical SQL injection vulnerability in WeGIA allows attackers to execute arbitrary database commands, leading to total data exfiltration or system disruption.

Vulnerability Details

CVE-ID: CVE-2026-31896

Affected Software: WeGIA

Affected Versions: Prior to 3.6.6

Vulnerability: The vulnerability stems from the use of extract($_REQUEST) followed by direct concatenation of variables into a SQL query. This allows an attacker to manipulate SQL queries, enabling unauthorized data access or denial-of-service via time-based attacks.

Business Impact

The severity of this flaw is underscored by the 9.8 CVSS score, indicating critical risk. An attacker can bypass security controls to extract the entire contents of the database, potentially including sensitive donor or institutional information, or render the application unusable.

Remediation Plan

Immediate Action: Update the WeGIA application to version 3.6.6 immediately to implement secure parameter binding and remove unsafe request handling.

Proactive Monitoring: Review database audit logs for anomalous query patterns, specifically looking for time-based delay commands or unexpected syntax.

Compensating Controls: Implement a Web Application Firewall (WAF) with SQL injection protection rules to block malicious requests targeting the vulnerable script.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Mar 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

SQL injection is a high-impact vulnerability that requires immediate attention. Administrators must prioritize the update to version 3.6.6 to eliminate the insecure query execution path and protect institutional data.

Description Summary:
WeGIA versions prior to 3.6.6 contain a SQL injection vulnerability in the restaurar_produto.php script, allowing authenticated attackers to execute arbitrary SQL commands via the id_produto parameter.

Executive Summary:
A critical SQL injection vulnerability in the WeGIA web manager for charitable institutions allows authenticated attackers to compromise database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-31895

Affected Software: LabRedesCefetRJ WeGIA

Affected Versions: < 3.6.6

Vulnerability: The application fails to properly sanitize the id_produto parameter within the html/matPat/restaurar_produto.php file. An authenticated user can inject malicious SQL commands, which are then executed directly by the backend database.

Business Impact

Successful exploitation allows an attacker to manipulate, steal, or delete sensitive data stored within the charitable institution database. Given the CVSS score of 8.8, this represents a high risk to data privacy and system integrity, potentially leading to unauthorized access to records and significant operational disruption.

Remediation Plan

Immediate Action: Update the WeGIA software to version 3.6.6 or later to incorporate the vendor-provided patch.

Proactive Monitoring: Review web access logs for unusual patterns or suspicious characters in the id_produto parameter of requests sent to the restaurar_produto.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection detection rules to inspect and filter malicious payloads directed at the vulnerable endpoint until the update can be applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of March 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input sanitization at the database layer.

Analyst Recommendation

The severity of this SQL injection flaw necessitates immediate remediation. Administrators should prioritize upgrading to version 3.6.6 across all instances to prevent unauthorized database access and potential data exfiltration.

Description Summary:
Unsafe use of the PHP extract() function in WeGIA allows unauthenticated attackers to overwrite local variables and bypass administrative authentication checks.

Executive Summary:
WeGIA is vulnerable to a critical variable overwrite flaw that enables unauthenticated attackers to bypass security controls and gain full administrative access to the application.

Vulnerability Details

CVE-ID: CVE-2026-28411

Affected Software: WeGIA

Affected Versions: Prior to version 3.6.5

Vulnerability: Multiple PHP scripts utilize the extract() function on the $_REQUEST superglobal without proper sanitization. This allows an unauthenticated attacker to overwrite critical variables, effectively neutralizing authentication and authorization logic.

Business Impact

A successful exploit allows an attacker to gain unauthorized access to administrative and protected areas, leading to a complete compromise of sensitive data held by the charitable institution. The CVSS score of 9.8 reflects the severity of this authentication bypass, which can result in total loss of confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Apply the update to WeGIA version 3.6.5 immediately, as this release removes the unsafe use of the extract() function.

Proactive Monitoring: Monitor web server logs for requests containing suspicious parameter names that match internal variable names, which may indicate an attempt to overwrite application logic.

Compensating Controls: Disable the use of extract() in the PHP configuration if possible, or use a WAF to filter out suspicious global variable names in incoming HTTP requests.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, variable overwrite vulnerabilities are a well-known vector for gaining administrative access, making this a high-priority target for attackers.

Analyst Recommendation

The ability for an unauthenticated attacker to gain administrative privileges via a simple variable overwrite is a critical risk. Immediate deployment of version 3.6.5 is the only reliable way to mitigate this flaw and protect the application from total takeover.

Description Summary:
A critical RCE vulnerability in WeGIA's database restoration allows administrative users to execute arbitrary OS commands via crafted filenames in backup uploads.

Executive Summary:
A critical remote code execution vulnerability in WeGIA allows administrative users to achieve full system compromise by uploading malicious backup files.

Vulnerability Details

CVE-ID: CVE-2026-28409

Affected Software: WeGIA Web Manager

Affected Versions: Versions prior to 3.6.5

Vulnerability: This vulnerability involves an arbitrary OS command injection within the database restoration functionality. While it requires administrative-level authentication, the risk is compounded by the existence of known authentication bypasses that can grant an attacker the necessary privileges to exploit this flaw.

Business Impact

Successful exploitation allows for complete control over the underlying server, potentially leading to the theft of sensitive charitable organization data, total service disruption, and permanent loss of database integrity. The CVSS score of 10.0 reflects the maximum possible severity, indicating that the integrity, availability, and confidentiality of the entire system are at extreme risk.

Remediation Plan

Immediate Action: Update the WeGIA application to version 3.6.5 or later immediately to patch the vulnerable database restoration logic.

Proactive Monitoring: Review system logs for unusual OS command execution originating from the web server user and monitor file upload directories for suspicious filenames.

Compensating Controls: Restrict access to the administrative interface to trusted IP addresses only and implement a Web Application Firewall (WAF) to detect command injection patterns.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Feb 27, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw and its potential pairing with authentication bypasses, the risk of exploitation is exceptionally high.

Analyst Recommendation

The CVSS 10.0 rating necessitates immediate intervention. IT administrators must prioritize the update to version 3.6.5, as this vulnerability provides a direct path to full server takeover once administrative access is obtained.

Description Summary:
A missing authentication and permission check in WeGIA allows unauthenticated attackers to inject massive amounts of unauthorized data into the application server's storage.

Executive Summary:
The WeGIA web manager contains a critical security flaw where a specific script lacks authentication checks, allowing unauthenticated attackers to perform unauthorized data injection.

Vulnerability Details

CVE-ID: CVE-2026-28408

Affected Software: WeGIA

Affected Versions: Prior to version 3.6.5

Vulnerability: The script adicionar_tipo_docs_atendido.php fails to implement central controller checks or independent authentication. This allows an unauthenticated external party to bypass permission levels and access features intended only for employees.

Business Impact

The ability for external parties to inject massive quantities of unauthorized data can lead to storage exhaustion and database corruption, resulting in significant system downtime. With a CVSS score of 9.8, this vulnerability represents a critical threat to data integrity and availability, potentially disrupting the core services of charitable institutions using the platform.

Remediation Plan

Immediate Action: Update the WeGIA installation to version 3.6.5 or later immediately to apply the necessary authentication and permission logic.

Proactive Monitoring: Review application storage and database logs for anomalous growth or entries created by unauthorized IP addresses, specifically targeting the adicionar_tipo_docs_atendido.php endpoint.

Compensating Controls: Restrict access to the application via IP whitelisting or implement a robust authentication proxy if an immediate update is not feasible.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Feb 27, 2026, there is no public information indicating active exploitation of this vulnerability. The technical simplicity of making direct requests to the vulnerable script via tools like Postman makes the likelihood of exploitation very high.

Analyst Recommendation

This vulnerability exposes the application to massive data manipulation and potential denial-of-service through storage exhaustion. Organizations must apply the version 3.6.5 update immediately to secure the application against unauthenticated external requests.

Description Summary:
An authenticated SQL injection vulnerability in the Atendido_ocorrenciaControle endpoint of WeGIA allows for database exfiltration and potential arbitrary file reads.

Executive Summary:
An authenticated SQL injection flaw in WeGIA, versions prior to 3.6.2, poses a high risk of total database compromise and sensitive data exfiltration.

Vulnerability Details

CVE-ID: CVE-2026-23723

Affected Software: LabRedesCefetRJ WeGIA

Affected Versions: < 3.6.2

Vulnerability: This is an SQL injection vulnerability (CWE-89) located in the Atendido_ocorrenciaControle endpoint, specifically triggered via the id_memorando parameter. The vulnerability requires the attacker to have authenticated access to the application.

Business Impact

Successful exploitation of this vulnerability allows an authenticated attacker to perform full database exfiltration, potentially exposing sensitive personally identifiable information (PII) of charitable institution members. Depending on server configuration, it may also lead to arbitrary file reads. With a CVSS score of 7.2, this represents a significant risk to data confidentiality and integrity, necessitating prompt remediation to prevent unauthorized access to sensitive records.

Remediation Plan

Immediate Action: Upgrade to WeGIA version 3.6.2 or later, which contains the official fix for this SQL injection vulnerability.

Proactive Monitoring: Review web server and database access logs for unusual patterns, such as unexpected SQL syntax characters (e.g., apostrophes, comment indicators) within requests to the Atendido_ocorrenciaControle endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the identified parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in GitHub repository Ch35h1r3c47/CVE-2026-23723-POC.

Analyst Notes: As of January 18, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable once an attacker has established authenticated access to the system.

Analyst Recommendation

Given the availability of a public proof-of-concept and the high potential for sensitive data exposure, administrators should prioritize updating WeGIA to version 3.6.2 immediately. Organizations unable to patch should verify that access controls are strictly enforced to minimize the risk of unauthorized users gaining the privileges required to trigger this flaw.

Description Summary:
A reflected cross-site scripting vulnerability in WeGIA allows unauthenticated attackers to inject malicious scripts via the id_memorando parameter in insere_despacho.php.

Executive Summary:
A critical reflected cross-site scripting vulnerability in the WeGIA web manager allows unauthenticated remote attackers to execute arbitrary code in a user's browser session.

Vulnerability Details

CVE-ID: CVE-2026-23722

Affected Software: LabRedesCefetRJ WeGIA

Affected Versions: < 3.6.2

Vulnerability: This is a reflected cross-site scripting (CWE-79) vulnerability occurring in the insere_despacho.php file. Unauthenticated attackers can inject malicious JavaScript by providing crafted input to the id_memorando GET parameter, which is rendered without proper sanitization.

Business Impact

The ability for an unauthenticated attacker to execute arbitrary scripts in a user's browser poses a significant risk to organizational security. Successful exploitation could lead to session hijacking, unauthorized access to sensitive charitable data, or the redirection of users to malicious sites, severely damaging institutional reputation. With a CVSS score of 9.1, this vulnerability represents a critical risk that requires immediate attention to prevent unauthorized account takeover.

Remediation Plan

Immediate Action: Update the WeGIA installation to version 3.6.2 or later to apply the necessary input sanitization fixes.

Proactive Monitoring: Inspect web server access logs for anomalous GET requests containing script tags or encoded characters directed at the insere_despacho.php endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with configured rules to detect and block common XSS patterns in URL parameters until the patch can be applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Jan 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible because it does not require user interaction or authentication.

Analyst Recommendation

Given the critical CVSS severity and the ease of exploitation, system administrators must prioritize patching this vulnerability immediately. Upgrading to version 3.6.2 effectively eliminates the input vector, and until the update is deployed, implementing WAF rules remains the most effective strategy to reduce the attack surface.

Description Summary:
WeGIA is vulnerable to SQL injection in the control.php endpoint, allowing authenticated attackers to execute arbitrary SQL commands via the id_produto parameter.

Executive Summary:
A critical SQL injection vulnerability in WeGIA versions prior to 3.5.0 allows authenticated attackers to potentially compromise the underlying database.

Vulnerability Details

CVE-ID: CVE-2025-59939

Affected Software: LabRedesCefetRJ WeGIA

Affected Versions: < 3.5.0

Vulnerability: The application is susceptible to CWE-89 (SQL Injection) via the control.php endpoint, specifically through the id_produto parameter. An attacker with low-level authenticated access can manipulate this parameter to execute unauthorized database queries.

Business Impact

Successful exploitation of this flaw allows an attacker to manipulate, extract, or delete sensitive data stored within the charitable institution's database. Given the CVSS score of 8.8, this vulnerability poses a high risk to data confidentiality, integrity, and availability, potentially leading to significant operational disruption and regulatory non-compliance.

Remediation Plan

Immediate Action: Upgrade the WeGIA installation to version 3.5.0 or later, which includes the necessary prepared statements and input validation to remediate the SQL injection flaw.

Proactive Monitoring: Review application access logs for unusual patterns or suspicious characters in the id_produto parameter, and monitor database audit logs for unauthorized queries originating from the web application service account.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns until the software can be patched.

Exploitation Status

Public Exploit Available: No (Exploit_available: unknown).

Analyst Notes: As of September 28, 2025, there is no public information indicating active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of proper input sanitization on a critical administrative endpoint.

Analyst Recommendation

Organizations utilizing WeGIA must prioritize the update to version 3.5.0 immediately to eliminate this attack vector. Failure to patch leaves the backend database exposed to unauthorized manipulation by any authenticated user, presenting a significant security risk to the institution's sensitive data.

Description Summary:
An arbitrary file upload vulnerability in WeGIA allows authenticated attackers to bypass MIME type checks and execute arbitrary PHP code via malicious file uploads.

Executive Summary:
A critical arbitrary file upload vulnerability in WeGIA allows authenticated attackers to achieve remote code execution on the underlying server.

Vulnerability Details

CVE-ID: CVE-2025-58745

Affected Software: LabRedesCefetRJ WeGIA

Affected Versions: < 3.4.11

Vulnerability: The application fails to properly validate file uploads at the endpoint /html/socio/sistema/controller/controla_xlsx.php, where an authenticated attacker can bypass MIME type restrictions by embedding malicious PHP code within a file containing Excel magic bytes. This flaw facilitates the upload and subsequent execution of web shells on the server.

Business Impact

Successful exploitation of this vulnerability leads to a complete compromise of the affected web server, granting the attacker full remote code execution capabilities. Given the CVSS score of 9.9, the potential for unauthorized data access, system manipulation, and lateral movement within the network is extreme, posing a severe risk to the integrity and availability of the charitable institution's digital assets.

Remediation Plan

Immediate Action: Update the WeGIA software immediately to version 3.4.11 or later to apply the necessary security patches.

Proactive Monitoring: Monitor server access logs for suspicious requests directed toward the /html/socio/sistema/controller/ directory and inspect the web server for unauthorized file creation or modified scripts.

Compensating Controls: Implement strict file upload policies and utilize a Web Application Firewall (WAF) to inspect incoming file traffic for non-permitted file extensions or malicious content signatures.

Exploitation Status

Public Exploit Available: No (Exploit available: unknown).

Analyst Notes: As of Sep 8, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the insufficient validation of file content beyond basic MIME type checks.

Analyst Recommendation

The severity of this vulnerability, combined with the ease of achieving remote code execution, necessitates an immediate upgrade to version 3.4.11. Security teams should prioritize patching this instance to prevent potential weaponization of the documented file upload flaw and ensure that all administrative access to the WeGIA platform is restricted to authorized personnel only.

Description Summary:
WeGIA is susceptible to remote code execution due to improper validation of uploaded files, allowing attackers to upload and execute arbitrary PHP files on the server.

Executive Summary:
A critical remote code execution vulnerability in WeGIA allows authenticated attackers to gain full control of the host server via arbitrary file uploads.

Vulnerability Details

CVE-ID: CVE-2025-58159

Affected Software: LabRedesCefetRJ WeGIA

Affected Versions: < 3.4.11

Vulnerability: This vulnerability involves an unrestricted file upload flaw where the application fails to sanitize filenames or extensions. An authenticated attacker can upload malicious files with a .php extension, which are then written to disk and executed by the server, resulting in complete system compromise.

Business Impact

The potential for remote code execution represents a total compromise of the application and the underlying server environment. With a CVSS score of 9.9, this vulnerability poses a critical threat to data confidentiality, integrity, and availability, potentially leading to unauthorized data exfiltration, service disruption, or the establishment of a persistent foothold for malicious actors.

Remediation Plan

Immediate Action: Upgrade the WeGIA installation to version 3.4.11 or later immediately to apply the necessary file validation and sanitization logic.

Proactive Monitoring: Review web server access logs for requests targeting unusual file extensions or suspicious upload directories, and monitor for unexpected child processes spawned by the web server user.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block uploads of files containing executable code extensions or suspicious content types until the software update can be applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 29, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible to attackers due to the lack of sufficient mitigation for previous file upload flaws.

Analyst Recommendation

Given the critical CVSS severity and the ease with which an attacker can achieve remote code execution, this vulnerability requires immediate attention. Organizations utilizing WeGIA must prioritize the update to version 3.4.11 to close the identified security gap and prevent potential system compromise.

Description Summary:
A SQL injection vulnerability exists in the WeGIA web manager for charitable institutions, allowing authenticated attackers to execute arbitrary SQL commands via the id_funcionario parameter.

Executive Summary:
A critical SQL injection vulnerability in WeGIA versions prior to 3.4.10 poses a severe risk to database confidentiality, integrity, and availability.

Vulnerability Details

CVE-ID: CVE-2025-57761

Affected Software: LabRedesCefetRJ WeGIA

Affected Versions: < 3.4.10

Vulnerability: This flaw is a SQL injection vulnerability (CWE-89) located in the /html/funcionario/dependente_remover.php endpoint. The vulnerability is triggered by an authenticated attacker manipulating the id_funcionario parameter to execute arbitrary database commands.

Business Impact

Successful exploitation of this vulnerability allows an attacker to gain unauthorized access to the underlying database, potentially leading to the theft of sensitive institutional data or complete loss of system integrity. With a CVSS score of 8.8, this vulnerability represents a high-severity risk that could cause significant operational disruption and compromise the personal information of users managed by the institution.

Remediation Plan

Immediate Action: Update the WeGIA software to version 3.4.10 or later immediately to incorporate the necessary input sanitization patches.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, particularly those involving the /html/funcionario/dependente_remover.php file or unusual SQL syntax.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the affected application parameter.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 23, 2025, there is no public information indicating active exploitation in the wild. However, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. SQL injection remains a highly exploitable class of vulnerability, and the potential for unauthorized data exfiltration is significant.

Analyst Recommendation

Given the severity of this vulnerability and the availability of a vendor-provided fix, administrators must prioritize upgrading their WeGIA instances to version 3.4.10. Failure to patch allows authenticated users to potentially compromise the entire database backend, making immediate remediation essential to maintaining the security posture of the institution.

Description Summary:
WeGIA versions prior to 3.4.5 contain a SQL injection vulnerability in the processa_deletar_socio.php endpoint, allowing unauthenticated attackers to execute arbitrary SQL commands.

Executive Summary:
A critical SQL injection vulnerability in WeGIA versions prior to 3.4.5 allows unauthenticated remote attackers to compromise the confidentiality, integrity, and availability of the database.

Vulnerability Details

CVE-ID: CVE-2025-53823

Affected Software: LabRedesCefetRJ WeGIA

Affected Versions: < 3.4.5

Vulnerability: This is a SQL injection flaw (CWE-89) located in the id_socio parameter of the /WeGIA/html/socio/sistema/processa_deletar_socio.php file. The vulnerability is exploitable by unauthenticated attackers with no required user interaction.

Business Impact

The ability to execute arbitrary SQL commands poses a severe risk to organizational operations, potentially leading to unauthorized data exfiltration, modification of sensitive records, or total system compromise. Given the CVSS score of 8.8, this vulnerability is classified as High severity, necessitating immediate remediation to prevent potential data breaches or service disruption.

Remediation Plan

Immediate Action: Upgrade to WeGIA version 3.4.5 or later, which contains the official security patch for this vulnerability.

Proactive Monitoring: Review web access logs for unusual patterns or suspicious characters in URL parameters targeting the processa_deletar_socio.php file.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block requests containing SQL syntax patterns targeting the identified vulnerable parameter until the software update can be applied.

Exploitation Status

Public Exploit Available: No (exploit_available unknown)

Analyst Notes: As of July 15, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is inherently dangerous due to its unauthenticated nature and the direct impact on database integrity.

Analyst Recommendation

Due to the ease of exploitation and the significant risk of database compromise, organizations utilizing WeGIA must prioritize upgrading to version 3.4.5 immediately. Failure to patch this vulnerability leaves the underlying data infrastructure exposed to potential remote attackers who can leverage the SQL injection flaw to gain unauthorized access or manipulate stored information.

Description Summary:
An unauthenticated SQL injection vulnerability exists in the WeGIA profile_funcionario.php endpoint via the id_funcionario parameter, allowing arbitrary SQL command execution.

Executive Summary:
The WeGIA web management software contains a critical SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2025-53529

Affected Software: LabRedesCefetRJ WeGIA

Affected Versions: < 3.4.3

Vulnerability: This is a classic SQL injection flaw (CWE-89) located in the /html/funcionario/profile_funcionario.php endpoint. The id_funcionario parameter fails to sanitize user input, allowing an unauthenticated remote attacker to manipulate database queries directly.

Business Impact

The severity of this vulnerability is critical, reflected by a CVSS score of 9.8. Successful exploitation grants an attacker full access to the database, which may contain sensitive information regarding charitable institutions, donors, or personnel. This could result in complete data exfiltration, unauthorized modification of records, or total administrative takeover of the underlying application environment.

Remediation Plan

Immediate Action: Upgrade the WeGIA installation to version 3.4.3 or higher immediately to apply the necessary input sanitization patches.

Proactive Monitoring: Monitor web server access logs for suspicious requests to the profile_funcionario.php endpoint, specifically looking for URL parameters containing SQL syntax or encoded characters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to block malicious payloads targeting the id_funcionario parameter until the software can be updated.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 7, 2025, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of required authentication and the direct exposure of the vulnerable endpoint.

Analyst Recommendation

Given the critical nature of this SQL injection vulnerability and the potential for total system compromise, administrators must prioritize patching this flaw immediately. The presence of a proof-of-concept elevates the risk to the environment, making rapid deployment of version 3.4.3 the only effective way to neutralize the threat.