CVE-2026-55684 is a critical SQL injection vulnerability in LabRedesCefetRJ's WeGIA web manager for charitable institutions. Versions prior to 3.8.6 have an unauthenticated endpoint that improperly handles user input in SQL INSERT statements, allowing remote attackers to execute arbitrary SQL commands. This can lead to unauthorized reading, modification, or deletion of sensitive data including billing, member, employee, permission, and credential information. The vulnerability is fixed in version 3.8.6.
CVE-2026-55682 is a high-severity vulnerability in LabRedesCefetRJ's WeGIA web manager for charitable institutions. Versions prior to 3.8.6 have a flaw in the session handling mechanism where an attacker-supplied PHPSESSID cookie is reflected in the Set-Cookie response with the internal database host name exposed as the cookie domain. This allows an attacker to hijack authenticated sessions if a victim uses the attacker-chosen session identifier. The issue affects all PHP pages and is fixed in version 3.8.6.
CVE-2026-55681 is a high-severity SQL injection vulnerability in the WeGIA web manager for charitable institutions. Prior to version 3.8.6, authenticated users with access to the Material & Patrimônio module can exploit improper sanitization of the id_produto parameter in a specific PHP script. This allows arbitrary SQL commands to be executed, potentially exposing or modifying sensitive institutional and inventory data. The vulnerability is fixed in version 3.8.6.
CVE-2026-55679 is an OS command injection vulnerability in the LabRedesCefetRJ WeGIA web manager for charitable institutions. Versions prior to 3.8.6 allow unauthenticated attackers to reach the pre-installation endpoint and inject commands via the 'usuario' parameter in the Linux reinstall flow. This leads to execution of arbitrary commands as the web-server user, persistence of attacker-controlled PHP configuration, and potential disruption or alteration of application data. The issue is fixed in version 3.8.6.
CVE-2026-55680 is a critical SQL injection vulnerability in WeGIA, a web manager for charitable institutions. Versions prior to 3.8.6 allow unauthenticated attackers to inject arbitrary SQL code via the 'codigo' parameter in a POST request to cadastro_cobranca.php. This vulnerability permits reading or modifying database content, including sensitive user credential hashes and billing records. The issue is fixed in version 3.8.6.
CVE-2026-55683 is a critical SQL injection vulnerability in the LabRedesCefetRJ WeGIA web manager for charitable institutions. Versions prior to 3.8.6 have an unauthenticated endpoint that improperly incorporates user input into SQL queries without using prepared statements. This allows remote attackers to execute arbitrary SQL commands, potentially reading, modifying, or deleting database content including billing records and credentials. The vulnerability is fixed in version 3.8.6.
CVE-2026-54767 is a critical vulnerability in LabRedesCefetRJ's WeGIA web manager for charitable institutions. Versions prior to 3.8.5 contain an unauthenticated GET endpoint that allows remote attackers to perform destructive database truncation operations without authorization. The vulnerability arises because the endpoint's access is controlled only by a hardcoded key embedded in the public source code. Exploitation can permanently delete member and contributor records. This issue is fixed in version 3.8.5.
CVE-2026-54671 is an authorization bypass vulnerability in LabRedesCefetRJ's WeGIA web manager for charitable institutions. Versions prior to 3.8.5 improperly map an internal control resource to an empty array, which the system treats as granting unconditional access to authenticated users. This flaw allows low-privileged users to read, modify, or delete other users' sensitive personal and medical records without verifying ownership. The issue is fixed in version 3.8.5.
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, the contribution request dispatcher in web/html/contribuicao/controller/control.php accepts attacker-controlled nomeClasse and metodo values without a complete controller and method allowlist, exempts sensitive ContribuicaoLogController operations from authentication, and constructs a controller include path without canonical directory containment. An unauthenticated remote attacker can invoke getContribuicoesLogJSON, sincronizarStatus, registrarFaturas, and other sensitive methods to disclose contribution and donation records or trigger financial workflow operations. A traversal-shaped nomeClasse value can also cause require_once to include an accessible PHP or configuration file outside the intended controller directory, exposing source code, credentials, or other sensitive local data. This issue is fixed in version 3.8.5.
WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an id_pessoa parameter through a request extraction function that overwrites the session-derived identifier. Attackers can enumerate all user identifiers to retrieve full profile data for any employee account, including name, CPF, address, contact details, and administrative flags.
WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of the alterarSenha method from permission checks in controle/control.php. Attackers can manipulate the redir parameter to point to alterar_senha.php, routing through verificarSenhaConfig() instead of verificarSenha() to bypass current password verification and convert temporary session access into permanent account takeover.
CVE-2026-45335 is an Open Redirect vulnerability in the WeGIA web manager for charitable institutions. The flaw exists in versions prior to 3.7.3 within the /WeGIA/controle/control.php endpoint, specifically involving the nextPage parameter when used with certain query parameters. The application does not properly validate or restrict this parameter, allowing attackers to redirect users to arbitrary external sites. This can facilitate phishing, credential theft, malware distribution, and social engineering attacks leveraging the trusted WeGIA domain. The vulnerability has a medium severity rating and a CVSS score of 5.4. It is fixed in version 3.
WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, when a user logs in, html/login.php hashes the submitted password using PHP's hash() function with the SHA-256 algorithm and no salt before comparing it to the stored value. The password change flow in controle/FuncionarioControle.php follows the same pattern. SHA-256 is a general-purpose cryptographic hash built for speed, not password storage. Without a salt, identical passwords produce identical digests, making the entire hash database vulnerable to a single precomputed rainbow table lookup. This vulnerability is fixed in 3.7.3.
CVE-2026-45026 is a stored Cross-Site Scripting (XSS) vulnerability in WeGIA, a web manager for charitable institutions. The flaw exists in versions prior to 3.7.3 and allows an authenticated user to inject malicious JavaScript into the Processo de Aceitação page. This script executes when users access the page, potentially enabling session hijacking and account takeover. The vulnerability has a medium severity with a CVSS score of 6.8. A fix is available in version 3.7.3.
WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript into the "Etapas de um Processo" (html/atendido/etapa_processo.php) page, which is executed when user access the the page, enabling session hijacking and account takeover. This vulnerability is fixed in 3.7.3.
WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a reflected Cross-Site Scripting (XSS) vulnerability exists in lista_arquivos_etapa.php due to improper handling of user-supplied input. The id_processo parameter is directly embedded into the HTML without sanitization, allowing attackers to inject arbitrary JavaScript. This can lead to session hijacking, credential theft, or execution of malicious actions in the context of the victim's browser. This vulnerability is fixed in 3.7.0.
WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a Stored Cross-Site Scripting (XSS) flaw was identified at the following endpoint: funcionario/profile_funcionario.php?id_funcionario=2. By injecting a malicious payload into the 'Description' (Descrição) field and saving the profile, the script becomes persistently stored. The payload is subsequently executed whenever the profile page is accessed. This vulnerability is fixed in 3.7.0.
WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, atendido/familiar_docfamiliar.php displays an overly descriptive error message, including database-related details. This verbosity leads to information disclosure, which could assist a potential attacker in mapping the backend infrastructure and expanding the attack surface. This vulnerability is fixed in 3.7.0.
WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, a Stored Cross-Site Scripting (XSS) vulnerability was identified in the 'Member Registration' (Cadastrar Sócio) function. By injecting a payload into the 'Member Name' (Nome Sócio) field, the script is persistently stored in the database. Consequently, the payload is executed whenever a user navigates to certain URL. Version 3.6.10 fixes the issue.
WeGIA is a web manager for charitable institutions. Versions prior to 3.6.10 contain a SQL injection vulnerability in dao/memorando/UsuarioDAO.php. The cpf_usuario POST parameter overwrites the session-stored user identity via extract($_REQUEST) in DespachoControle::verificarDespacho(), and the attacker-controlled value is then interpolated directly into a raw SQL query, allowing any authenticated user to query the database under an arbitrary identity. Version 3.6.10 fixes the issue.