Is there a patch available for CVE-2026-42871?

Yes, a patch is available for CVE-2026-42871. Update the affected software to the latest version immediately.

WeGIA CVE-2026-42871

Q: What is the CVSS score of CVE-2026-42871?

CVE-2026-42871 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29186 MEDIUM

Information Exposure (CWE-200)

2026-05-11 GitHub_M

PHP Information Disclosure Wegia Labredescefetrj

6.9

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.3 MEDIUM

Network-reachable endpoint with no authentication leaks only limited database metadata in error output, yielding low confidentiality impact and no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:55 vuln.today

Patch available

May 11, 2026 - 20:02 EUVD

CVSS changed

May 11, 2026 - 19:22 NVD

6.9 (MEDIUM)

CVE Published

May 11, 2026 - 18:31 nvd

UNKNOWN (no severity yet)

CVE Published

May 11, 2026 - 18:31 nvd

MEDIUM 6.9

DescriptionGitHub Advisory

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, atendido/familiar_docfamiliar.php displays an overly descriptive error message, including database-related details. This verbosity leads to information disclosure, which could assist a potential attacker in mapping the backend infrastructure and expanding the attack surface. This vulnerability is fixed in 3.7.0.

AnalysisAI

Verbose error messages in WeGIA versions prior to 3.7.0 expose database-related details through the unauthenticated PHP endpoint atendido/familiar_docfamiliar.php, enabling remote attackers to map backend infrastructure and identify further attack vectors. The CVSS 4.0 score of 6.9 reflects network-accessible, zero-authentication exploitation with partial confidentiality impact and no integrity or availability consequence. A proof-of-concept has been identified per SSVC classification, though EPSS sits at just 0.04% (13th percentile), indicating limited broad exploitation interest; no active exploitation has been confirmed via CISA KEV.

Technical ContextAI

WeGIA is a PHP-based web management platform for charitable institutions, maintained by LabRedesCefetRJ (CPE: cpe:2.3:a:labredescefetrj:wegia:*:*:*:*:*:*:*:*). The vulnerability originates in atendido/familiar_docfamiliar.php, a PHP script that fails to suppress internal error output, falling squarely under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). In PHP applications, verbose error handling - such as leaving display_errors enabled or failing to catch exceptions cleanly - can leak database driver names, query structures, table names, connection parameters, or stack traces. This class of flaw is particularly dangerous as a reconnaissance enabler: it does not directly compromise data but substantially lowers the cost of follow-on attacks against the database layer or application logic.

RemediationAI

Upgrade WeGIA to version 3.7.0, which is confirmed to fix this vulnerability per the vendor advisory at https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-xpvm-3f74-qvp2. If an immediate upgrade is not possible, a targeted workaround is to configure the PHP environment to suppress error output by setting display_errors = Off and log_errors = On in the relevant php.ini or .htaccess, redirecting errors to a server-side log file inaccessible to end users - note this addresses the symptom but not the underlying missing error handling in the application code. Additionally, restricting network access to the atendido/familiar_docfamiliar.php endpoint via web server ACLs or firewall rules to authorized IP ranges can reduce exposure, though this may impact legitimate users of the charitable institution management workflow.