WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript via the "Destinatário" field. The payload is stored and later executed when viewing the dispatch page, impacting other users. Version 3.6.10 fixes the issue.
WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript into the Intercorrências notification page, which is executed when user access the the page, enabling session hijacking and account takeover. Version 3.6.10 fixes the issue.
WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript via the "Nome" field in the "Informações Pacientes" page. The payload is stored and executed when the patient information is viewed. Version 3.6.10 fixes the issue.
CVE-2026-35475 is an open redirect vulnerability in the WeGIA web manager for charitable institutions. Versions prior to 3.6.9 do not validate or whitelist the redirect parameter, allowing untrusted URLs to be used directly in HTTP Location headers. This vulnerability is fixed in version 3.6.9. The CVSS 4.0 base score is 5.1, indicating a medium severity level.
CVE-2026-35474 is an open redirect vulnerability in the WeGIA web application, a web manager for charitable institutions. Versions prior to 3.6.9 do not validate or whitelist the redirect parameter, allowing it to be used directly in an HTTP Location header. This can lead to users being redirected to untrusted sites. The vulnerability has a medium severity score of 5.1 and is fixed in version 3.6.9.
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarId and nomeClasse=IentradaControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain. This vulnerability is fixed in 3.6.9.
CVE-2026-35399 is a stored cross-site scripting (XSS) vulnerability in the WeGIA web manager for charitable institutions, affecting versions prior to 3.6.9. The vulnerability allows attackers to inject malicious scripts via a backup filename, which can execute in the context of a victim's browser. This could lead to unauthorized actions or session compromise. The issue is fixed in version 3.6.9. The vulnerability has a high severity score of 8.5 and does not currently have known exploits in the wild.
An Open Redirect vulnerability (CWE-601) exists in the WeGIA web application prior to version 3.6.9. The issue occurs in the /WeGIA/controle/control.php endpoint via the nextPage parameter when used with specific query parameters. This allows attackers to redirect users to arbitrary external sites, potentially facilitating phishing, credential theft, or malware distribution. The vulnerability is fixed in version 3.6.9.
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarTodos & listarId_Nome and nomeClasse=OrigemControle. The application fails to validate or restrict the nextPage parameter, allowing attackers to redirect users to arbitrary external websites. This can be abused for phishing attacks, credential theft, malware distribution, and social engineering using the trusted WeGIA domain. This vulnerability is fixed in 3.6.9.
CVE-2026-35396 is an Open Redirect vulnerability in the WeGIA web application versions prior to 3.6.9. The flaw exists in the /WeGIA/controle/control.php endpoint where the nextPage parameter is not properly validated when used with specific parameters, allowing attackers to redirect users to arbitrary external sites. This can facilitate phishing, credential theft, malware distribution, and social engineering attacks leveraging the trusted WeGIA domain. The vulnerability has a medium severity score of 5.1 and is fixed in version 3.6.9.
WeGIA, a web management system for charitable institutions, has a SQL injection vulnerability in versions prior to 3.6.9. The vulnerability exists because the id_memorando parameter is taken from user input without validation and directly used in SQL queries. This allows any authenticated user to execute arbitrary SQL commands on the database. The issue is fixed in version 3.6.9. The vulnerability has a high severity with a CVSS score of 8.8.
WeGIA is a web manager for charitable institutions. Prior to version 3.6.7, the file `html/socio/sistema/deletar_tag.php` uses `extract($_REQUEST)` on line 14 and directly concatenates the `$id_tag` variable into SQL queries on lines 16-17 without prepared statements or sanitization. Version 3.6.7 patches the vulnerability.
WeGIA is a web manager for charitable institutions. Versions 3.6.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability in the listar_memorandos_ativos.php endpoint. An attacker can inject arbitrary JavaScript or HTML tags into the sccd GET parameter, which is then directly echoed into the HTML response without any sanitization or encoding. The script /html/memorando/listar_memorandos_ativos.php handles dynamic success messages to users using query string parameters. Similar to other endpoints in the Memorando module, it checks if $_GET['msg'] equals 'success'. If this condition is met, it directly concatenates and reflects $_GET['sccd'] into an HTML alert <div>. This issue is resolved in version 3.6.7.
WeGIA is a web manager for charitable institutions. Versions 3.6.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability in the novo_memorandoo.php endpoint. An attacker can inject arbitrary JavaScript into the sccs GET parameter, which is directly echoed into the HTML response without any sanitization or encoding. The script /html/memorando/novo_memorandoo.php reads HTTP GET parameters to display dynamic success messages to the user. At approximately line 273, the code checks if $_GET['msg'] equals 'success'. If true, it directly concatenates $_GET['sccs'] into an HTML alert <div> and outputs it to the browser. This issue has been fixed in version 3.6.7.
CVE-2026-33134 is a critical SQL Injection vulnerability in WeGIA, a web management system for charitable institutions, affecting versions 3.6.5 and below. The flaw exists in the html/matPat/restaurar_produto.php endpoint, where the id_produto GET parameter is unsafely interpolated into SQL queries without sanitization or parameterization. An authenticated attacker can exploit this to execute arbitrary SQL commands, potentially leading to full database compromise. The vulnerability has been fixed in version 3.6.6. Exploitation requires authentication but no user interaction, and the vulnerability allows high confidentiality impact with limited integrity impact and no availability impact.
WeGIA is a web manager for charitable institutions. In versions 3.6.5 and 3.6.6, the loadBackupDB() function imports SQL files from uploaded backup archives without any content validation. An attacker can craft a backup archive containing arbitrary SQL statements that create rogue administrator accounts, modify existing passwords, or execute any database operation. This was introduced in commit 370104c. This issue was patched in version 3.6.7.
CVE-2026-31896 is a critical SQL injection vulnerability in the WeGIA web management application for charitable institutions, affecting versions prior to 3.6.6. The vulnerability arises from the remover_produto_ocultar.php script using extract($_REQUEST) and directly concatenating variables into SQL queries without proper sanitization. This flaw allows an attacker, potentially without authentication, to execute arbitrary SQL commands, leading to data exfiltration or denial of service via time-based delays. The vulnerability has a CVSS score of 9.8, indicating critical severity, and is fixed in version 3.6.6.
WeGIA is a web manager for charitable institutions. Prior to version 3.6.6, WeGIA (Web gerenciador para instituições assistenciais) contains a SQL injection vulnerability in html/matPat/restaurar_produto.php. The id_produto parameter from $_GET is directly interpolated into SQL queries without parameterization or sanitization. This vulnerability is fixed in 3.6.6.
CVE-2026-31894 is a medium severity vulnerability in WeGIA version 3.6.5, a web manager for charitable institutions. The vulnerability arises from improper handling of symbolic links during extraction and reading of tar.gz archives in the loadBackupDB() function. Specifically, the PharData class extracts archives without validating symbolic links, and subsequent file reading operations do not verify if files are symlinks, leading to potential unauthorized file access or overwriting. This flaw is fixed in version 3.6.6. Exploitation requires high privileges but no user interaction or authentication, and no known exploits are currently reported.
WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, an unsafe use of the `extract()` function on the `$_REQUEST` superglobal allows an unauthenticated attacker to overwrite local variables in multiple PHP scripts. This vulnerability can be leveraged to completely bypass authentication checks, allowing unauthorized access to administrative and protected areas of the WeGIA application. Version 3.6.5 fixes the issue.