WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, a critical Remote Code Execution (RCE) vulnerability exists in the WeGIA application's database restoration functionality. An attacker with administrative access (which can be obtained via the previously reported Authentication Bypass) can execute arbitrary OS commands on the server by uploading a backup file with a specifically crafted filename. Version 3.6.5 fixes the issue.
WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, the script in adicionar_tipo_docs_atendido.php does not go through the project's central controller and does not have its own authentication and permission checks. A malicious user could make a request through tools like Postman or the file's URL on the web to access features exclusive to employees. The vulnerability allows external parties to inject unauthorized data in massive quantities into the application server's storage. Version 3.6.5 fixes the issue.
CVE-2026-23731 is a medium-severity clickjacking vulnerability affecting versions of the WeGIA web manager prior to 3.6.2. The application lacks critical HTTP headers such as X-Frame-Options and Content-Security-Policy frame-ancestors, allowing attackers to embed WeGIA pages within malicious frames. This enables overlaying deceptive UI elements to trick users into unintended interactions, potentially compromising sensitive workflows. The vulnerability does not impact confidentiality or availability directly but can lead to integrity issues through unauthorized actions. Exploitation requires user interaction but no authentication or complex attack vectors. The issue is fixed in version 3.6.2.
CVE-2026-23730 is an Open Redirect vulnerability in the WeGIA web management application used by charitable institutions. The flaw exists in versions prior to 3.6.2 within the /WeGIA/controle/control.php endpoint, specifically via the nextPage parameter when combined with certain query parameters. The application does not properly validate or restrict this parameter, allowing attackers to redirect users to arbitrary external sites. This can facilitate phishing, credential theft, malware distribution, and social engineering by exploiting the trusted WeGIA domain. The vulnerability has a medium severity score of 4.8 and does not require authentication but does require user interaction. No known exploits are currently reported in the wild.
CVE-2026-23729 is an Open Redirect vulnerability in the WeGIA web management application used by charitable institutions. The flaw exists in versions prior to 3.6.2 within the /WeGIA/controle/control.php endpoint, specifically via the nextPage parameter when combined with certain query parameters. The application does not properly validate or restrict the nextPage parameter, enabling attackers to redirect users to arbitrary external sites. This vulnerability can be exploited for phishing, credential theft, malware distribution, and social engineering by leveraging the trusted WeGIA domain. The vulnerability has a CVSS score of 4.8 (medium severity) and does not require authentication but does require user interaction. No known exploits are currently reported in the wild.
CVE-2026-23728 is an Open Redirect vulnerability in the WeGIA web manager for charitable institutions, affecting versions prior to 3.6.2. The flaw exists in the /WeGIA/controle/control.php endpoint via the nextPage parameter when used with metodo=listarTodos and nomeClasse=DestinoControle, allowing attackers to redirect users to arbitrary external sites. This can facilitate phishing, credential theft, malware distribution, and social engineering by exploiting the trusted WeGIA domain. The vulnerability requires no authentication but does require user interaction to follow the malicious link. It has a CVSS score of 4.8, indicating medium severity, and has no known exploits in the wild. The issue is fixed in version 3.
CVE-2026-23727 is an Open Redirect vulnerability in the WeGIA web management application used by charitable institutions. The flaw exists in versions prior to 3.6.2 within the /WeGIA/controle/control.php endpoint, specifically via the nextPage parameter when combined with certain query parameters. The application does not properly validate or restrict this parameter, allowing attackers to redirect users to arbitrary external sites. This can facilitate phishing, credential theft, malware distribution, and social engineering attacks leveraging the trusted WeGIA domain. The vulnerability has a medium severity score of 4.8 and does not require authentication but does require user interaction. No known exploits are currently reported in the wild.
CVE-2026-23726 is an Open Redirect vulnerability in the WeGIA web management application for charitable institutions, affecting versions prior to 3.6.2. The flaw exists in the /WeGIA/controle/control.php endpoint via the nextPage parameter when used with specific query parameters, allowing attackers to redirect users to arbitrary external sites. This vulnerability can facilitate phishing, credential theft, malware distribution, and social engineering by exploiting the trust users place in the legitimate WeGIA domain. The vulnerability has a CVSS score of 4.8 (medium severity) and does not require authentication but does require user interaction. No known exploits are currently reported in the wild. The issue is fixed in version 3.
CVE-2026-23725 is a stored Cross-Site Scripting (XSS) vulnerability in versions of the WeGIA web management application prior to 3.6.2. The flaw exists in the html/pet/adotantes/cadastro_adotante.php and informacao_adotantes.php endpoints where user input is not properly sanitized before being rendered, allowing persistent injection of malicious JavaScript. Any user visiting the affected pages will automatically execute the injected script, potentially leading to session hijacking, defacement, or other malicious actions. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity.
CVE-2026-23724 is a medium severity stored Cross-Site Scripting (XSS) vulnerability in the WeGIA web management application for charitable institutions, specifically affecting versions prior to 3.6.2. The vulnerability exists in the html/atendido/cadastro_ocorrencia.php endpoint where user input is not properly sanitized before being rendered inside a dropdown selection, allowing malicious scripts to be stored and executed in users' browsers. Exploitation requires network access and low privileges but no user interaction, potentially leading to confidentiality breaches such as session hijacking or data exposure. The vulnerability has a CVSS score of 4.3 and is fixed in version 3.6.2.
CVE-2026-23722 is a critical reflected Cross-Site Scripting (XSS) vulnerability in the WeGIA web management system for charitable institutions, affecting versions prior to 3.6.2. The flaw exists in the insere_despacho.php script where the id_memorando GET parameter is not properly sanitized or encoded before being reflected in the HTML output. This allows unauthenticated attackers to inject malicious JavaScript, potentially compromising user sessions and data confidentiality and integrity. The vulnerability has a CVSS score of 9.1, indicating high severity, and does not require user interaction or authentication to exploit. Although no known exploits are currently reported in the wild, the vulnerability poses a significant risk to organizations using affected versions of WeGIA. The issue is fixed in version 3.
CVE-2026-23723 is an authenticated SQL Injection vulnerability in the WeGIA web management system for charitable institutions, affecting versions prior to 3.6.2. The flaw exists in the Atendido_ocorrenciaControle endpoint via the id_memorando parameter, allowing attackers with valid credentials to exfiltrate the entire database, access sensitive personally identifiable information (PII), and potentially read arbitrary files in misconfigured environments. The vulnerability has a CVSS score of 7.2, indicating high severity, and does not require user interaction but does require authentication. Although no known exploits are currently reported in the wild, the impact on confidentiality, integrity, and availability is significant. The vulnerability is fixed in version 3.6.2.
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Versions 3.5.4 and below contain an SQL Injection vulnerability in the /html/matPat/editar_categoria.php endpoint. The application fails to properly validate and sanitize user inputs in the id_categoria parameter, which allows attackers to inject malicious SQL payloads for direct execution. This issue is fixed in version 3.5.5.
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Versions 3.5.4 and below contain a Stored Cross-Site Scripting (XSS) vulnerability in the /WeGIA/html/geral/configurar_senhas.php endpoint. The application does not sanitize user-controlled data before rendering it inside the employee selection dropdown. The application retrieves employee names from the database and injects them directly into HTML <option> elements without proper escaping. This issue is fixed in version 3.5.5.
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to version 3.5.1, a reflected cross-site scripting (XSS) vulnerability was identified in the editar_info_pessoal.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the action parameter. The vulnerable endpoint is GET /WeGIA/html/pessoa/editar_info_pessoal.php?action=1. This issue has been patched in version 3.5.1.
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to version 3.5.1, a reflected cross-site scripting (XSS) vulnerability was identified in the editar_info_pessoal.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the sql parameter. The vulnerable endpoint is GET /WeGIA/html/pessoa/editar_info_pessoal.php?sql=1. This issue has been patched in version 3.5.1.
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.0, an Open Redirect vulnerability was identified in the control.php endpoint of the WeGIA application, specifically in the nextPage parameter (metodo=listarTodos nomeClasse=AlmoxarifeControle). This vulnerability allows attackers to redirect users to arbitrary external domains, enabling phishing campaigns, malicious payload distribution, or user credential theft. This vulnerability is fixed in 3.5.0.
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.Prior to 3.5.1, a SQL Injection vulnerability was identified in the /html/funcionario/dependente_documento.php endpoint, specifically in the id_dependente parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This vulnerability is fixed in 3.5.1.
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.0, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the /pet/profile_pet.php?id_pet= endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the id_pet parameter. This vulnerability is fixed in 3.5.0.
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.1, the log parameter in configuracao_geral.php is vulnerable to Reflected Cross-Site Scripting (XSS). An attacker can inject arbitrary JavaScript, which executes in the victim’s browser. This vulnerability is fixed in 3.5.1.