What’s Vulnerable › Products

LabRedesCefetRJ WeGIA vulnerabilities

205 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 88 published in the last 12 months.

Check whether your LabRedesCefetRJ WeGIA version is affected

Latest LabRedesCefetRJ WeGIA vulnerabilities

• CVE-2026-61719 — WeGIA: Stored Cross-Site Scripting (XSS) in "historico_prontuarios.php" via "textoProntuario" Field (CVSS 8.9)
• CVE-2026-61673 — WeGIA: Stored DOM XSS in listar_despachos.php Allows Account Takeover (CVSS 6.3)
• CVE-2026-61671 — WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes (CVSS 8.1)
• CVE-2026-55684 — WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php (CVSS 9.8)
• CVE-2026-55683 — WeGIA: SQL Injection in html/socio/sistema/cadastro_cobranca.php (CVSS 9.8)
• CVE-2026-55682 — WeGIA: Session Fixation via User-Controlled PHPSESSID Cookie + DB_HOST Leak in html/seguranca/sessionStart.php (CVSS 8.1)
• CVE-2026-55681 — WeGIA: SQL Injection in html/matPat/restaurar_produto_desocultar.php via id_produto parameter (CVSS 8.8)
• CVE-2026-55680 — WeGIA: Unauthenticated SQL Injection in cadastro_cobranca.php via "codigo" parameter (CVSS 9.8)
• CVE-2026-55679 — WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection (CVSS 6.5)
• CVE-2026-54767 — WeGIA: Hardcoded Secret Key Backdoor — Mass Data Destruction via deletar_socios.php (CVSS 9.1)
• CVE-2026-54671 — WeGIA: Authorization Bypass via Empty Resource Array in InternoControle (CVSS 8.8)
• CVE-2026-54670 — WeGIA: Unauthenticated Auth Bypass + Local File Inclusion (CVSS 9.1)
• CVE-2026-76634 — WeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.php (CVSS 6.5)
• CVE-2026-76633 — WeGIA < 3.9.2 Authorization Bypass Password Change via alterarSenha (CVSS 8.1)
• CVE-2026-45335 — WeGIA: Middleware whitelist bypass → open redirect via InternoControle.nextPage (CVSS 5.4)
• CVE-2026-45027 — WeGIA: Use of Weak Password Hashing Algorithm (SHA-256, no salt) in html/login.php (CVSS 5.9)
• CVE-2026-45026 — WeGIA: Stored XSS in html/atendido/processo_aceitacao.php (CVSS 6.8)
• CVE-2026-45025 — WeGIA: Stored XSS in html/atendido/etapa_processo.php (CVSS 6.8)
• CVE-2026-42873 — WeGIA: Error Handling Upload DocDependente (CVSS 0.0)
• CVE-2026-42872 — WeGIA: Reflected XSS in listar_arquivos_etapa.php (CVSS 6.1)
• CVE-2026-42870 — WeGIA: Cross-Site Scripting (XSS) Stored endpoint 'informacao_adicional.php' parameter 'descricao' (CVSS 6.4)
• CVE-2026-42871 — WeGIA: Error Handling familiar_docfamiliar (CVSS 6.9)
• CVE-2026-40286 — WeGIA has Cross-Site Scripting in Controle de Contribuição (CVSS 7.5)
• CVE-2026-40285 — WeGIA has SQL Injection via Session Variable Override in DespachoControle.php (CVSS 8.8)
• CVE-2026-40284 — WeGIA has stored XSS in listar_despachos.php (CVSS 6.8)