Wegia
Monthly
Unauthenticated, unauthenticated-by-design HTTP GET requests to WeGIA's deletar_socios.php endpoint before version 3.8.5 can irrevocably wipe member and contributor records, because the endpoint's only gate is a SHA-256 comparison against a hardcoded key string that ships in the public source repository and is therefore known to any attacker who reads the code. Per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N, no session, credential, or user interaction is needed; the practical limits are that the target must run a pre-3.8.5 release, the endereco, pessoafisica, pessoajuridica, and socio tables must exist, and the web process's database account must hold TRUNCATE privileges. With a CVSS base score of 9.1 and integrity/availability impact rated High (and no confidentiality impact), the flaw is a low-friction data-destruction issue; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, though the required key value is exposed by design in the repository. Vendor-released patch: 3.8.5.
Unauthenticated remote attackers can invoke sensitive financial and record-disclosure methods inside WeGIA's contribution dispatcher and, using a traversal-shaped controller name, force require_once to load PHP or configuration files from outside the intended controller directory. Because the pre-3.8.5 dispatcher in web/html/contribuicao/controller/control.php hardcoded an authentication exemption for ContribuicaoLogController and enforced no controller/method allowlist, methods such as getContribuicoesLogJSON, sincronizarStatus and registrarFaturas are reachable by anyone with HTTP access, leaking contribution and donation records or triggering financial workflow operations. Rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), this is a genuine high-priority issue; no public exploit identified at time of analysis, and it is fixed in version 3.8.5.
Password change authorization bypass in WeGIA before 3.9.2 allows any authenticated user to permanently take over their own account - or one they hold temporary session access to - without supplying the existing password. The `alterarSenha` method is unconditionally excluded from permission checks in `controle/control.php`, and manipulating the `redir` parameter routes password-change requests through `verificarSenhaConfig()` rather than the credential-verifying `verificarSenha()`, stripping the old-password requirement entirely. No public exploit code has been identified at time of analysis, though the mechanically simple parameter manipulation lowers the practical bar significantly.
Stored Cross-Site Scripting in WeGIA 'Member Registration' function allows remote attackers to inject malicious JavaScript through the 'Member Name' field, achieving persistent code execution in victim browsers without authentication. The payload executes whenever users navigate to affected pages, enabling session hijacking, credential theft, or administrative action execution. Version 3.6.10 provides a vendor-released patch. No public exploit identified at time of analysis, though exploitation is straightforward given the unauthenticated attack vector (CVSS AV:N/PR:N).
SQL injection in WeGIA charitable institution manager allows authenticated users to impersonate arbitrary identities and execute database queries with elevated privileges. The cpf_usuario parameter in dao/memorando/UsuarioDAO.php bypasses session-based identity controls through PHP's extract($_REQUEST) function, enabling any low-privileged authenticated user to query sensitive data or modify database contents as any other user, including administrators. WeGIA versions before 3.6.10 are affected. No public exploit identified at time of analysis, though exploitation complexity is low (CVSS AC:L) requiring only valid user credentials.
Stored XSS in WeGIA patient management system (versions before 3.6.10) allows authenticated high-privilege users to inject malicious JavaScript via the patient name field, with execution occurring when patient records are subsequently viewed. The vulnerability affects all instances of WeGIA prior to version 3.6.10, where the fix has been released. Exploitation requires administrative or high-privilege account access but can compromise confidentiality and session integrity of users viewing affected patient records.
Stored cross-site scripting (XSS) in WeGIA Web manager for charitable institutions allows remote attackers to inject malicious scripts via specially crafted backup filenames, leading to session hijacking or unauthorized actions performed in victim browsers. Affects versions prior to 3.6.9. No public exploit identified at time of analysis, though CVSS 8.5 reflects high impact to confidentiality and integrity with low attack complexity and no authentication requirements.
SQL injection in WeGIA 3.6.8 and earlier allows authenticated users to execute arbitrary SQL commands through the id_memorando parameter in DespachoDAO.php. The vulnerability affects WeGIA, a web-based management system for charitable institutions, enabling attackers with valid credentials to potentially exfiltrate sensitive donor/beneficiary data, modify records, or compromise database integrity. No public exploit identified at time of analysis, with EPSS data not available for this recent CVE. Vendor-released patch available in version 3.6.9.
SQL injection in WeGIA charitable institution management software allows authenticated remote attackers to execute arbitrary database queries with high impact to confidentiality, integrity, and availability. The vulnerability stems from unsafe use of extract($_REQUEST) combined with unsanitized SQL concatenation in the tag deletion module (deletar_tag.php), affecting all versions prior to 3.6.7. No public exploit identified at time of analysis, with EPSS probability data not available for this recent CVE.
WeGIA, a web manager for charitable institutions, contains a Reflected Cross-Site Scripting (XSS) vulnerability in the listar_memorandos_ativos.php endpoint affecting versions 3.6.6 and below. An attacker can inject arbitrary JavaScript or HTML into the sccd GET parameter, which is reflected without sanitization when the msg parameter equals 'success', enabling session hijacking, credential theft, and malicious actions in the context of victim users. The vulnerability has a critical CVSS score of 9.3 with changed scope, indicating potential impact beyond the vulnerable component.
A Reflected Cross-Site Scripting (XSS) vulnerability exists in WeGIA, a web manager for charitable institutions. Versions 3.6.6 and below are affected through the novo_memorandoo.php endpoint, where an attacker can inject arbitrary JavaScript via the sccs GET parameter without sanitization. This allows execution of malicious scripts in victims' browsers when they click a crafted link, with a critical CVSS score of 9.3 due to cross-site scripting scope and high confidentiality and integrity impact.
WeGIA, a web manager for charitable institutions, contains an authenticated SQL injection vulnerability in versions 3.6.5 and below via the id_producto parameter in the restaurar_produto.php endpoint. An authenticated attacker can execute arbitrary SQL commands to fully compromise the database, extracting sensitive donor information, beneficiary records, and administrative credentials. No evidence of active exploitation (not in CISA KEV) is currently available, though proof-of-concept details are publicly disclosed in the GitHub security advisory.
WeGIA versions 3.6.5 and 3.6.6 contain an unauthenticated SQL injection vulnerability in the loadBackupDB() function that fails to validate SQL content within uploaded backup archives. An attacker can craft a malicious backup file to execute arbitrary SQL statements, including creation of rogue administrator accounts, password modification, or complete database compromise. The vulnerability was introduced in commit 370104c and patched in version 3.6.7; no active exploitation in the wild has been confirmed, but the simplicity of the attack vector and availability of proof-of-concept references via GitHub advisory suggest moderate real-world risk.
SQL injection in WeGIA before 3.6.6.
WeGIA is a web manager for charitable institutions. versions up to 3.6.6 is affected by sql injection (CVSS 8.8).
WeGIA 3.6.5 allows unauthenticated remote attackers to read arbitrary files on the server through symlink traversal in backup database extraction functionality. When processing tar.gz archives, the application fails to validate whether extracted members are symbolic links before reading their contents, enabling an attacker to access sensitive files like database credentials or configuration data. No patch is currently available for this vulnerability.
Authentication bypass via unsafe extract() function in WeGIA before 3.6.5. The extract() call on user-controlled data allows overwriting authentication variables. EPSS 0.7% with PoC available.
Critical RCE via OS command injection in WeGIA before 3.6.5. Unauthenticated attackers can execute arbitrary commands on the server. CVSS 10.0 with PoC available.
Authentication bypass in WeGIA charitable institution management system before 3.6.5. The adicionar_tipo_docs_atendido.php script lacks authentication, allowing unauthorized access. PoC available.
SQL injection in WeGIA's Atendido_ocorrenciaControle endpoint allows authenticated attackers to manipulate the id_memorando parameter and extract entire databases, exposing sensitive personal information and potentially reading arbitrary files on misconfigured systems. Public exploit code exists for this vulnerability affecting WeGIA versions prior to 3.6.2. A patch is available in version 3.6.2 and should be deployed immediately to affected charitable institution management systems.
WeGIA web manager for charitable institutions has a reflected XSS vulnerability prior to version 3.6.2 that enables account takeover through crafted malicious links.
Stored Cross-Site Scripting in WeGIA versions prior to 3.7.3 allows authenticated high-privilege users to inject malicious JavaScript into the Processo de Aceitação page that executes when any user accesses the vulnerable endpoint, enabling session hijacking and account takeover. The vulnerability is confined to high-privilege authenticated access (PR:H) with no user interaction required on the victim side, though scope is changed (S:C) indicating cross-context impact. No public exploit code or active exploitation has been identified.
Stored cross-site scripting (XSS) in WeGIA versions prior to 3.7.3 allows authenticated high-privilege users to inject malicious JavaScript into the Etapas de um Processo page, which executes when other users access the page, enabling session hijacking and account takeover. The vulnerability requires high-privilege authentication (PR:H) but affects all users who subsequently visit the injected page, with no public exploit identified at time of analysis.
Information disclosure in WeGIA versions prior to 3.6.10 allows authenticated remote attackers to obtain sensitive technical details through overly descriptive error messages in the file upload endpoint (funcionario/docdependente_upload.php), expanding the attack surface for subsequent exploitation attempts.
Reflected cross-site scripting (XSS) in WeGIA versions before 3.7.0 allows unauthenticated remote attackers to inject arbitrary JavaScript via the id_processo parameter in lista_arquivos_etapa.php, enabling session hijacking, credential theft, or malicious actions in victim browsers. User interaction (clicking a crafted link) is required. The vulnerability is fixed in version 3.7.0.
Stored XSS in WeGIA's employee profile module affects all versions prior to 3.7.0, enabling persistent JavaScript injection via the Description (Descrição) field at the funcionario/profile_funcionario.php endpoint. Any party able to edit that field can plant a payload that executes silently in every subsequent visitor's browser - including administrators - enabling session hijacking and privileged action execution. A proof-of-concept exists per SSVC assessment; however, no CISA KEV listing and an EPSS of 0.05% (15th percentile) indicate no observed widespread exploitation at time of analysis.
Verbose error messages in WeGIA versions prior to 3.7.0 expose database-related details through the unauthenticated PHP endpoint `atendido/familiar_docfamiliar.php`, enabling remote attackers to map backend infrastructure and identify further attack vectors. The CVSS 4.0 score of 6.9 reflects network-accessible, zero-authentication exploitation with partial confidentiality impact and no integrity or availability consequence. A proof-of-concept has been identified per SSVC classification, though EPSS sits at just 0.04% (13th percentile), indicating limited broad exploitation interest; no active exploitation has been confirmed via CISA KEV.
Stored XSS in WeGIA versions prior to 3.6.10 allows authenticated high-privilege users to inject malicious JavaScript via the Destinatário field, with payloads persisted and executed when other users view the dispatch page. The vulnerability requires administrative or high-privilege authentication but impacts confidentiality of all users accessing affected pages. No public exploit code or active exploitation has been reported.
Stored Cross-Site Scripting in WeGIA versions prior to 3.6.10 allows authenticated users to inject malicious JavaScript into the Intercorrências notification page, which executes when other users access that page, enabling session hijacking and account takeover. The vulnerability requires user authentication to inject the payload but affects all subsequent viewers of the notification page without additional user interaction. Patch version 3.6.10 resolves the issue.
Open redirect vulnerability in WeGIA web manager prior to version 3.6.9 allows unauthenticated remote attackers to redirect users to arbitrary external URLs by injecting a malicious redirect parameter into HTTP requests. The vulnerability exploits missing URL validation on the redirect parameter, which is passed directly to PHP's header() function without sanitization or whitelist checks. User interaction is required as the victim must click a crafted link, but successful exploitation can facilitate phishing attacks or credential theft by redirecting users to attacker-controlled domains that masquerade as legitimate institutional websites.
Open Redirect vulnerability in WeGIA versions prior to 3.6.9 allows unauthenticated remote attackers to redirect users to arbitrary external websites via the unvalidated nextPage parameter in the /WeGIA/controle/control.php endpoint when combined with specific parameters (metodo=listarTodos and nomeClasse=EstoqueControle). Attackers can exploit the application's trusted domain to conduct phishing attacks, steal credentials, distribute malware, or execute social engineering campaigns. The vulnerability has been patched in version 3.6.9.
Open redirect vulnerability in WeGIA versions prior to 3.6.9 allows unauthenticated remote attackers to redirect users to arbitrary external websites via the nextPage parameter in the /WeGIA/controle/control.php endpoint. By combining this with specific query parameters (metodo=listarTodos, listarId_Nome, nomeClasse=OrigemControle), attackers can leverage the trusted WeGIA domain for phishing, credential harvesting, malware distribution, and social engineering attacks. The vulnerability is fixed in version 3.6.9.
Open redirect in WeGIA web management application versions prior to 3.6.9 allows unauthenticated remote attackers to redirect users to arbitrary external websites via an unvalidated nextPage parameter in the /WeGIA/controle/control.php endpoint. By crafting a malicious URL combining metodo=listarId and nomeClasse=IsaidaControle parameters, attackers can leverage the application's trusted domain for phishing, credential harvesting, malware distribution, and social engineering attacks. The vulnerability is fixed in version 3.6.9.
Open redirect vulnerability in WeGIA web application versions prior to 3.6.9 allows unauthenticated remote attackers to redirect users to arbitrary external URLs via an unvalidated redirect parameter in GET requests. The vulnerability requires user interaction (clicking a malicious link) and has limited confidentiality and integrity impact. This is fixed in version 3.6.9.
Open redirect vulnerability in WeGIA web manager versions prior to 3.6.9 allows unauthenticated remote attackers to redirect users to arbitrary external websites via the unvalidated nextPage parameter in the /WeGIA/controle/control.php endpoint. The vulnerability requires user interaction (clicking a malicious link) but leverages the trusted WeGIA domain to facilitate phishing, credential theft, and malware distribution attacks. This issue is fixed in version 3.6.9.
WeGIA prior to version 3.6.2 lacks framing protection headers (X-Frame-Options and Content-Security-Policy), allowing attackers to perform clickjacking attacks by embedding the application within malicious web pages to trick users into unintended actions. Public exploit code exists for this vulnerability, affecting charitable institutions using vulnerable versions of the web manager.
WeGIA charitable institution management software versions prior to 3.6.2 contain an open redirect vulnerability in the control.php endpoint that fails to validate the nextPage parameter, allowing unauthenticated attackers to redirect users to arbitrary external sites for phishing and credential theft. Public exploit code exists for this vulnerability. The flaw is resolved in version 3.6.2 and later.
WeGIA charitable institution management software versions prior to 3.6.2 contain an open redirect vulnerability in the control.php endpoint that fails to validate the nextPage parameter, allowing attackers to redirect authenticated users to malicious external sites. Public exploit code exists for this vulnerability, which can be leveraged for phishing, credential harvesting, and malware distribution attacks while maintaining the appearance of a trusted WeGIA domain. The vulnerability is resolved in WeGIA 3.6.2 and later versions.
WeGIA versions prior to 3.6.2 contain an open redirect vulnerability in the control.php endpoint that fails to properly validate the nextPage parameter, allowing attackers to redirect authenticated users to malicious external sites. Public exploit code exists for this vulnerability, enabling attackers to conduct phishing campaigns and credential harvesting attacks while leveraging the trust associated with the legitimate WeGIA domain. Update to version 3.6.2 or later to remediate this issue.
WeGIA versions prior to 3.6.2 contain an open redirect vulnerability in the control.php endpoint that fails to validate the nextPage parameter, allowing unauthenticated attackers to redirect users to arbitrary external websites. Public exploit code exists for this vulnerability, which can be leveraged for phishing, credential harvesting, and malware distribution attacks that abuse the trusted WeGIA domain. The vulnerability is resolved in version 3.6.2.
WeGIA prior to version 3.6.2 contains an open redirect vulnerability in the control.php endpoint that fails to validate the nextPage parameter, allowing attackers to craft malicious links redirecting users to arbitrary external sites for phishing and credential theft. Public exploit code exists for this vulnerability, which affects all users who click attacker-controlled links within the application. The vulnerability is resolved in version 3.6.2.
Stored XSS in WeGIA before version 3.6.2 allows authenticated users to inject malicious scripts into adopter information fields that execute in the browsers of all visitors to the affected pages. Public exploit code exists for this vulnerability, which impacts the html/pet/adotantes/cadastro_adotante.php and informacao_adotantes.php endpoints. Organizations should upgrade to version 3.6.2 or later to mitigate the risk of persistent JavaScript injection attacks.
Stored XSS in WeGIA's attendance incident form allows authenticated attackers to inject malicious scripts through unsanitized dropdown fields, affecting versions prior to 3.6.2. An attacker with login credentials can craft payloads that execute in other users' browsers when they view the affected page. Public exploit code exists for this vulnerability, and a patch is available in version 3.6.2 and later.
SQL injection in WeGIA 3.5.4 and earlier allows an authenticated user who holds edit-level permission on the matPat (materials/patrimony) module to execute arbitrary SQL against the backend database via the id_categoria parameter of /html/matPat/editar_categoria.php. Because the endpoint enforces an active session and a resource-22 permission check, exploitation realistically requires a legitimate privileged account or stolen credentials rather than an anonymous remote attacker, although publicly available exploit code exists and the CVSS 4.0 base score of 9.4 reflects full confidentiality, integrity and availability impact on both the vulnerable system and downstream components. The vendor addressed the flaw in WeGIA 3.5.5; EPSS is low at 0.51% (42nd percentile) and there is no indication of confirmed active exploitation in CISA KEV.
Stored cross-site scripting in WeGIA 3.5.4 and earlier allows an authenticated low-privileged user who can create or edit employee records to persist a JavaScript payload that later executes in the browser of any victim - realistically an administrator - who loads /WeGIA/html/geral/configurar_senhas.php and views the unsanitized employee dropdown. Publicly available exploit code exists, but exploitation requires an authenticated account (PR:L) plus victim interaction (UI:R), and the EPSS score of 0.25% (15th percentile) indicates a low likelihood of exploitation, so this is a genuine but moderate-priority issue rather than an emergency. The vendor fixed the defect in version 3.5.5.
Reflected cross-site scripting in WeGIA (Web Manager for Institutions) versions prior to 3.5.1 lets an attacker inject malicious script through the 'action' parameter of the GET endpoint /WeGIA/html/pessoa/editar_info_pessoal.php, which is reflected back without sanitization. Because the flaw is reflected rather than stored, exploitation requires a victim to open an attacker-crafted URL (user interaction), and the injected script then runs in that victim's browser context - meaning impact is limited to the targeted user's session rather than the server. Publicly available exploit code exists and the vendor has confirmed the issue in GitHub advisory GHSA-jmm7-rr7w-f223, but there is no evidence of confirmed active exploitation (not in CISA KEV), and EPSS rates the likelihood of exploitation low at roughly 0.24% (14th percentile); no authentication is required to craft the link (PR:N in the CVSS vector), though meaningful impact depends on targeting an authenticated or active WeGIA user.
Reflected cross-site scripting in WeGIA lets remote, unauthenticated attackers execute arbitrary JavaScript in a victim's browser by supplying a crafted value to the sql parameter of the editar_info_pessoal.php endpoint, and all versions before 3.5.1 are affected. Successful exploitation requires the victim to open an attacker-crafted link, so impact is confined to client-side script execution within the WeGIA origin rather than server-side compromise, matching the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. Publicly available exploit code exists, but EPSS is only 0.29 percent (20th percentile) and there is no confirmed active exploitation (no CISA KEV listing); the vendor-released patch is WeGIA 3.5.1.
An open redirect in WeGIA versions prior to 3.5.0 lets an authenticated low-privilege user redirect victims to arbitrary external domains via the nextPage parameter of the control.php endpoint (metodo=listarTodos, nomeClasse=AlmoxarifeControle). Because the destination is attacker-controlled and only format-validated, the flaw enables phishing, malicious payload delivery, or credential theft against users who click a crafted link; exploitation also requires victim interaction (UI:R) and a valid low-privilege session (PR:L), so it is not an unauthenticated internet-facing redirect. Publicly available exploit code exists, the EPSS score is low at 0.22% (12th percentile), and the issue is confirmed fixed in 3.5.0; it is not listed in CISA KEV, so there is no evidence of active exploitation.
SQL injection in WeGIA prior to 3.5.1 allows an authenticated remote attacker to execute arbitrary SQL statements through the id_dependente POST parameter of the /html/funcionario/dependente_documento.php endpoint, fully compromising the confidentiality, integrity, and availability of the underlying database. The endpoint enforces an authenticated session ($_SESSION['usuario'] plus permissao.php), so valid credentials or a hijacked session are required, but no user interaction or special configuration is needed and the attack complexity is low. Publicly available exploit code exists, including an Exploit-DB entry and GitHub security advisories, and EPSS estimates roughly a 0.9% probability of exploitation in the near term (58th percentile); the vulnerability is fixed in WeGIA 3.5.1.
Reflected cross-site scripting (XSS) in WeGIA versions prior to 3.5.0 lets an attacker inject arbitrary script via the id_pet parameter of /pet/profile_pet.php, causing it to execute in the browser of an authenticated victim who opens a crafted link. Reaching the vulnerable endpoint requires an active authenticated session holding the pet-module permission (permissao($_SESSION['id_pessoa'], 63, 7)), so the attacker needs a victim who is logged in and authorized - the impact is confined to that victim's browser session, with no server-side confidentiality, integrity, or availability loss. Vendor-released patch: 3.5.0; publicly available exploit code exists, but EPSS is only 0.23% (13th percentile) and there is no confirmed active exploitation, making this a moderate-severity, low-priority issue.
Reflected cross-site scripting (XSS) in WeGIA versions prior to 3.5.1 allows unauthenticated attackers to inject arbitrary JavaScript that executes in a victim's browser when the victim opens a crafted link, enabling session theft, credential harvesting, or page defacement within the application's origin. The flaw resides in the base64-decoded 'log' GET parameter processed by html/configuracao/configuracao_geral.php and rendered unescaped inside a <pre> tag via the message helpers in html/geral/msg.php. Publicly available exploit code exists and the vendor has released a fix in 3.5.1; EPSS is low at 0.26% (16th percentile) and there is no confirmed active exploitation (CISA KEV). Exploitation requires user interaction (UI:R) - the victim must follow an attacker-supplied link - so real-world risk is moderate and dependent on social engineering.
SQL injection in WeGIA versions prior to 3.5.1 allows an authenticated attacker with administrative privileges to execute arbitrary SQL statements through the cpf parameter of the /html/funcionario/cadastro_funcionario_pessoa_existente.php endpoint, fully compromising the confidentiality, integrity, and availability of the underlying database. The flaw is rated CVSS 4.0 8.6 (High) and requires a high-privileged session (PR:H), so realistic exploitation is limited to attackers who already hold admin credentials or to insider/privilege-abuse scenarios. Publicly available exploit code exists (referenced via the GitHub security advisory GHSA-x36x-x5j4-wfjf), but EPSS is low at 0.43% (35th percentile) and there is no indication of active exploitation in CISA KEV.
Reflected cross-site scripting in WeGIA versions prior to 3.5.1 lets an authenticated, low-privilege attacker inject script into the idatendido GET parameter of the /html/atendido/cadastro_atendido_parentesco_pessoa_nova.php endpoint, which is echoed unsanitized into a hidden input field and executes in the victim's browser when a crafted link is clicked. Exploitation requires a valid WeGIA session (PR:L) plus victim interaction (UI:R), and impact is limited to the browser context with low confidentiality and integrity effects and no availability impact. The flaw is fixed in WeGIA 3.5.1, publicly available exploit code exists, and EPSS is low at 0.24% (13th percentile) with no indication of confirmed active exploitation.
SQL injection in WeGIA's employee-dependents endpoint (/html/funcionario/dependente_listar.php) lets a logged-in user with access to that feature execute arbitrary SQL against the backend database, compromising the confidentiality, integrity, and availability of stored data. The flaw affects every WeGIA release prior to 3.5.1 and is triggered through the id_funcionario POST parameter; because the endpoint enforces a valid $_SESSION["usuario"] and a permissao.php check, the attack is authenticated (PR:H) rather than unauthenticated. Publicly available exploit code exists and the vendor has shipped a fix in 3.5.1, but EPSS is low (0.53%, 43rd percentile) and there is no confirmed active exploitation (no CISA KEV listing).
Unauthenticated information disclosure in WeGIA 3.4.12 and earlier allows remote attackers to retrieve sensitive personal and financial records of members simply by requesting the /html/socio/sistema/get_relatorios_socios.php endpoint, which prior to version 3.5.0 performs no session or permission validation before returning query results. The flaw is a broken access control issue (CWE-200) with a CVSS v4.0 base score of 8.7 and high confidentiality impact, and the CVSS vector (PR:N) confirms exploitation requires no authentication. Publicly available exploit code exists, but EPSS is low at 0.17% (38th percentile) and there is no confirmation of active exploitation in CISA KEV; the vendor-released fix is version 3.5.0.
Open redirect in WeGIA 3.4.12 and earlier lets an authenticated attacker craft a link to the control.php endpoint (metodo=listarUm&nomeClasse=FuncionarioControle) whose unsanitised nextPage parameter is reflected directly into an HTTP Location header, sending a victim who clicks it to any external domain the attacker chooses. The CVSS vector (PR:L, UI:A) confirms a valid WeGIA session context is required and that the victim must actively click the crafted link, so the practical impact is limited to phishing-style abuse - credential theft or delivery of malicious payloads under the trusted institution's domain - rather than server compromise. Publicly available exploit code exists (the vendor's own GHSA-m64v-hm7q-33wr advisory) and EPSS is only 0.04% (10th percentile); there is no CISA KEV listing, and the independent assessment rates this a genuinely low-priority, real-world-low-risk issue despite the MEDIUM CVSS of 4.8. The vulnerability is fixed in WeGIA 3.5.0.
SQL injection in the WeGIA web manager (versions 3.4.12 and below) lets an authenticated user who holds the pet-module permission execute arbitrary SQL against the backend MySQL database via the id_pet parameter of /pet/profile_pet.php, compromising confidentiality, integrity and availability of stored data. Publicly available exploit code exists, although EPSS is low at 0.04% (14th percentile) and the vulnerability is not listed in CISA KEV, so confirmed active exploitation has not been observed and the practical risk is gated by the requirement for a valid, low-privileged WeGIA session with access to the pet profile feature. The issue is fixed in version 3.5.0.
WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Cross-Site Request Forgery (CSRF) vulnerability. The delete operation for the Almoxarifado entity is exposed via HTTP GET without CSRF protection, allowing a third-party site to trigger the action using the victim’s authenticated session. This issue is fixed in version 3.5.0.
Authenticated SQL injection in WeGIA 3.4.12 and earlier allows a logged-in user to execute arbitrary SQL statements through the descricao parameter handled by the /controle/control.php endpoint, compromising the confidentiality, integrity, and availability of the underlying database. Exploitation requires a valid WeGIA session with access to the product-registration workflow (assessed vector PR:L, network reachable, no user interaction), and publicly available exploit code exists, although EPSS is only 0.03% (9th percentile), indicating limited observed activity so far. The vendor addressed the flaw in version 3.5.0 by sanitizing product input and replacing the concatenated query with a PDO prepared statement.
WeGIA is a Web manager for charitable institutions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Remote code execution in WeGIA allows an authenticated low-privileged user to upload a PHP webshell through the Excel-import endpoint /html/socio/sistema/controller/controla_xlsx.php by prepending Excel magic bytes to a PHP file, defeating the endpoint's MIME-type-only check. Versions before 3.4.11 are affected, and the 3.4.11 release contains the complete fix for this incomplete remediation of CVE-2025-22133. Publicly available exploit code exists, while EPSS is 0.22% (44th percentile), indicating low predicted exploitation likelihood.
WeGIA is a Web manager for charitable institutions. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WeGIA is a Web manager for charitable institutions. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WeGIA is a Web manager for charitable institutions. Rated low severity (CVSS 2.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Authenticated remote code execution in WeGIA prior to 3.4.11 lets a low-privilege user upload a spreadsheet carrying trailing PHP code under an attacker-controlled .php filename, which the application writes to a web-accessible location and executes. The flaw is an incomplete fix for CVE-2025-22133, requires PR:L credentials and access to the upload feature, and is not exploitable by unauthenticated users. Publicly available exploit code exists; EPSS is 0.65% (71st percentile), so prioritization should focus on exposed WeGIA deployments that permit low-privilege uploads.
WeGIA is a Web manager for charitable institutions. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
WeGIA is a Web manager for charitable institutions. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
WeGIA is a Web manager for charitable institutions. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WeGIA is a Web manager for charitable institutions. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
WeGIA is a Web manager for charitable institutions. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the editar_permissoes.php endpoint of the WeGIA application prior to version 3.4.4. This vulnerability allows attackers to inject malicious scripts in the msg_c parameter. Version 3.4.4 fixes the issue.
WeGIA versions prior to 3.4.5 contain a SQL Injection vulnerability in the member deletion endpoint that allows authenticated users to execute arbitrary SQL commands via the `id_socio` parameter. This high-severity vulnerability (CVSS 8.8) compromises the confidentiality, integrity, and availability of the entire database. The vulnerability requires valid credentials to exploit but offers complete database compromise once authenticated.
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `relatorio_geracao.php` endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject malicious scripts in the `tipo_relatorio` parameter. Version 3.4.5 has a patch for the issue.
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. An Open Redirect vulnerability exists in the web application prior to version 3.4.5. The control.php endpoint allows to specify an arbitrary URL via the `nextPage` parameter, leading to an uncontrolled redirection. Version 3.4.5 contains a fix for the issue.
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `index.php` endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject malicious scripts in the `erro` parameter. Version 3.4.5 contains a patch for the issue.
WeGIA is a web manager for charitable institutions. The Wegia server has a vulnerability that allows excessively long HTTP GET requests to a specific URL. This issue arises from the lack of validation for the length of the fid parameter. Tests confirmed that the server processes URLs up to 8,142 characters, resulting in high resource consumption, elevated latency, timeouts, and read errors. This makes the server susceptible to Denial of Service (DoS) attacks. This vulnerability is fixed in 3.3.0.
WeGIA is a web manager for charitable institutions. The Wegia server has a vulnerability that allows excessively long HTTP GET requests to a specific URL. This issue arises from the lack of validation for the length of the errorstr parameter. Tests confirmed that the server processes URLs up to 8,142 characters, resulting in high resource consumption, elevated latency, timeouts, and read errors. This makes the server susceptible to Denial of Service (DoS) attacks. This vulnerability is fixed in 3.3.0.
WeGIA is a web manager for charitable institutions. An SQL Injection vulnerability was identified in the /html/funcionario/profile_funcionario.php endpoint. The id_funcionario parameter is not properly sanitized or validated before being used in a SQL query, allowing an unauthenticated attacker to inject arbitrary SQL commands. The vulnerability is fixed in 3.4.3.
WeGIA is a web manager for charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in the almox parameter of the /controle/relatorio_geracao.php endpoint. This issue allows attacker to inject arbitrary SQL queries, potentially leading to unauthorized data access or further exploitation depending on database configuration. This vulnerability is fixed in 3.4.1.
WeGIA is a web manager for charitable institutions. An XSS Injection vulnerability was identified in novo_memorando.php. After the memo was submitted, the vulnerability was confirmed by accessing listar_memorandos_antigos.php. Upon loading this page, the injected script was executed in the browser. This vulnerability is fixed in 3.4.3.
WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the profile_familiar.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the id_dependente parameter. This vulnerability is fixed in 3.4.3.
WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the cadastro_dependente_pessoa_nova.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the id_funcionario parameter. This vulnerability is fixed in 3.4.3.
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in version 3.3.3 the almox parameter of the `/controle/getProdutosPorAlmox.php` endpoint. This issue allows any unauthenticated attacker to inject arbitrary SQL queries, potentially leading to unauthorized data access or further exploitation depending on database configuration. Version 3.4.0 fixes the issue.
Cross-site scripting in WeGIA 3.4.0 allows remote attackers with low privileges to inject scripts via employee registration form fields. A proof-of-concept exploit is publicly available, but no active exploitation has been confirmed. The vendor did not respond to disclosure, leaving the vulnerability unpatched.
Cross-site scripting in WeGIA 3.4.0 allows a remote authenticated low-privileged attacker to inject arbitrary web script via the 'Insira o novo tipo' parameter in the adicionar_tipoSaida.php page. Successful exploitation requires user interaction and can lead to session hijacking or unauthorized actions on behalf of the victim. Public exploit code exists but no active widespread exploitation has been reported.
Unauthenticated, unauthenticated-by-design HTTP GET requests to WeGIA's deletar_socios.php endpoint before version 3.8.5 can irrevocably wipe member and contributor records, because the endpoint's only gate is a SHA-256 comparison against a hardcoded key string that ships in the public source repository and is therefore known to any attacker who reads the code. Per the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N, no session, credential, or user interaction is needed; the practical limits are that the target must run a pre-3.8.5 release, the endereco, pessoafisica, pessoajuridica, and socio tables must exist, and the web process's database account must hold TRUNCATE privileges. With a CVSS base score of 9.1 and integrity/availability impact rated High (and no confidentiality impact), the flaw is a low-friction data-destruction issue; no public exploit code was identified at time of analysis and the issue is not in CISA KEV, though the required key value is exposed by design in the repository. Vendor-released patch: 3.8.5.
Unauthenticated remote attackers can invoke sensitive financial and record-disclosure methods inside WeGIA's contribution dispatcher and, using a traversal-shaped controller name, force require_once to load PHP or configuration files from outside the intended controller directory. Because the pre-3.8.5 dispatcher in web/html/contribuicao/controller/control.php hardcoded an authentication exemption for ContribuicaoLogController and enforced no controller/method allowlist, methods such as getContribuicoesLogJSON, sincronizarStatus and registrarFaturas are reachable by anyone with HTTP access, leaking contribution and donation records or triggering financial workflow operations. Rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), this is a genuine high-priority issue; no public exploit identified at time of analysis, and it is fixed in version 3.8.5.
Password change authorization bypass in WeGIA before 3.9.2 allows any authenticated user to permanently take over their own account - or one they hold temporary session access to - without supplying the existing password. The `alterarSenha` method is unconditionally excluded from permission checks in `controle/control.php`, and manipulating the `redir` parameter routes password-change requests through `verificarSenhaConfig()` rather than the credential-verifying `verificarSenha()`, stripping the old-password requirement entirely. No public exploit code has been identified at time of analysis, though the mechanically simple parameter manipulation lowers the practical bar significantly.
Stored Cross-Site Scripting in WeGIA 'Member Registration' function allows remote attackers to inject malicious JavaScript through the 'Member Name' field, achieving persistent code execution in victim browsers without authentication. The payload executes whenever users navigate to affected pages, enabling session hijacking, credential theft, or administrative action execution. Version 3.6.10 provides a vendor-released patch. No public exploit identified at time of analysis, though exploitation is straightforward given the unauthenticated attack vector (CVSS AV:N/PR:N).
SQL injection in WeGIA charitable institution manager allows authenticated users to impersonate arbitrary identities and execute database queries with elevated privileges. The cpf_usuario parameter in dao/memorando/UsuarioDAO.php bypasses session-based identity controls through PHP's extract($_REQUEST) function, enabling any low-privileged authenticated user to query sensitive data or modify database contents as any other user, including administrators. WeGIA versions before 3.6.10 are affected. No public exploit identified at time of analysis, though exploitation complexity is low (CVSS AC:L) requiring only valid user credentials.
Stored XSS in WeGIA patient management system (versions before 3.6.10) allows authenticated high-privilege users to inject malicious JavaScript via the patient name field, with execution occurring when patient records are subsequently viewed. The vulnerability affects all instances of WeGIA prior to version 3.6.10, where the fix has been released. Exploitation requires administrative or high-privilege account access but can compromise confidentiality and session integrity of users viewing affected patient records.
Stored cross-site scripting (XSS) in WeGIA Web manager for charitable institutions allows remote attackers to inject malicious scripts via specially crafted backup filenames, leading to session hijacking or unauthorized actions performed in victim browsers. Affects versions prior to 3.6.9. No public exploit identified at time of analysis, though CVSS 8.5 reflects high impact to confidentiality and integrity with low attack complexity and no authentication requirements.
SQL injection in WeGIA 3.6.8 and earlier allows authenticated users to execute arbitrary SQL commands through the id_memorando parameter in DespachoDAO.php. The vulnerability affects WeGIA, a web-based management system for charitable institutions, enabling attackers with valid credentials to potentially exfiltrate sensitive donor/beneficiary data, modify records, or compromise database integrity. No public exploit identified at time of analysis, with EPSS data not available for this recent CVE. Vendor-released patch available in version 3.6.9.
SQL injection in WeGIA charitable institution management software allows authenticated remote attackers to execute arbitrary database queries with high impact to confidentiality, integrity, and availability. The vulnerability stems from unsafe use of extract($_REQUEST) combined with unsanitized SQL concatenation in the tag deletion module (deletar_tag.php), affecting all versions prior to 3.6.7. No public exploit identified at time of analysis, with EPSS probability data not available for this recent CVE.
WeGIA, a web manager for charitable institutions, contains a Reflected Cross-Site Scripting (XSS) vulnerability in the listar_memorandos_ativos.php endpoint affecting versions 3.6.6 and below. An attacker can inject arbitrary JavaScript or HTML into the sccd GET parameter, which is reflected without sanitization when the msg parameter equals 'success', enabling session hijacking, credential theft, and malicious actions in the context of victim users. The vulnerability has a critical CVSS score of 9.3 with changed scope, indicating potential impact beyond the vulnerable component.
A Reflected Cross-Site Scripting (XSS) vulnerability exists in WeGIA, a web manager for charitable institutions. Versions 3.6.6 and below are affected through the novo_memorandoo.php endpoint, where an attacker can inject arbitrary JavaScript via the sccs GET parameter without sanitization. This allows execution of malicious scripts in victims' browsers when they click a crafted link, with a critical CVSS score of 9.3 due to cross-site scripting scope and high confidentiality and integrity impact.
WeGIA, a web manager for charitable institutions, contains an authenticated SQL injection vulnerability in versions 3.6.5 and below via the id_producto parameter in the restaurar_produto.php endpoint. An authenticated attacker can execute arbitrary SQL commands to fully compromise the database, extracting sensitive donor information, beneficiary records, and administrative credentials. No evidence of active exploitation (not in CISA KEV) is currently available, though proof-of-concept details are publicly disclosed in the GitHub security advisory.
WeGIA versions 3.6.5 and 3.6.6 contain an unauthenticated SQL injection vulnerability in the loadBackupDB() function that fails to validate SQL content within uploaded backup archives. An attacker can craft a malicious backup file to execute arbitrary SQL statements, including creation of rogue administrator accounts, password modification, or complete database compromise. The vulnerability was introduced in commit 370104c and patched in version 3.6.7; no active exploitation in the wild has been confirmed, but the simplicity of the attack vector and availability of proof-of-concept references via GitHub advisory suggest moderate real-world risk.
SQL injection in WeGIA before 3.6.6.
WeGIA is a web manager for charitable institutions. versions up to 3.6.6 is affected by sql injection (CVSS 8.8).
WeGIA 3.6.5 allows unauthenticated remote attackers to read arbitrary files on the server through symlink traversal in backup database extraction functionality. When processing tar.gz archives, the application fails to validate whether extracted members are symbolic links before reading their contents, enabling an attacker to access sensitive files like database credentials or configuration data. No patch is currently available for this vulnerability.
Authentication bypass via unsafe extract() function in WeGIA before 3.6.5. The extract() call on user-controlled data allows overwriting authentication variables. EPSS 0.7% with PoC available.
Critical RCE via OS command injection in WeGIA before 3.6.5. Unauthenticated attackers can execute arbitrary commands on the server. CVSS 10.0 with PoC available.
Authentication bypass in WeGIA charitable institution management system before 3.6.5. The adicionar_tipo_docs_atendido.php script lacks authentication, allowing unauthorized access. PoC available.
SQL injection in WeGIA's Atendido_ocorrenciaControle endpoint allows authenticated attackers to manipulate the id_memorando parameter and extract entire databases, exposing sensitive personal information and potentially reading arbitrary files on misconfigured systems. Public exploit code exists for this vulnerability affecting WeGIA versions prior to 3.6.2. A patch is available in version 3.6.2 and should be deployed immediately to affected charitable institution management systems.
WeGIA web manager for charitable institutions has a reflected XSS vulnerability prior to version 3.6.2 that enables account takeover through crafted malicious links.
Stored Cross-Site Scripting in WeGIA versions prior to 3.7.3 allows authenticated high-privilege users to inject malicious JavaScript into the Processo de Aceitação page that executes when any user accesses the vulnerable endpoint, enabling session hijacking and account takeover. The vulnerability is confined to high-privilege authenticated access (PR:H) with no user interaction required on the victim side, though scope is changed (S:C) indicating cross-context impact. No public exploit code or active exploitation has been identified.
Stored cross-site scripting (XSS) in WeGIA versions prior to 3.7.3 allows authenticated high-privilege users to inject malicious JavaScript into the Etapas de um Processo page, which executes when other users access the page, enabling session hijacking and account takeover. The vulnerability requires high-privilege authentication (PR:H) but affects all users who subsequently visit the injected page, with no public exploit identified at time of analysis.
Information disclosure in WeGIA versions prior to 3.6.10 allows authenticated remote attackers to obtain sensitive technical details through overly descriptive error messages in the file upload endpoint (funcionario/docdependente_upload.php), expanding the attack surface for subsequent exploitation attempts.
Reflected cross-site scripting (XSS) in WeGIA versions before 3.7.0 allows unauthenticated remote attackers to inject arbitrary JavaScript via the id_processo parameter in lista_arquivos_etapa.php, enabling session hijacking, credential theft, or malicious actions in victim browsers. User interaction (clicking a crafted link) is required. The vulnerability is fixed in version 3.7.0.
Stored XSS in WeGIA's employee profile module affects all versions prior to 3.7.0, enabling persistent JavaScript injection via the Description (Descrição) field at the funcionario/profile_funcionario.php endpoint. Any party able to edit that field can plant a payload that executes silently in every subsequent visitor's browser - including administrators - enabling session hijacking and privileged action execution. A proof-of-concept exists per SSVC assessment; however, no CISA KEV listing and an EPSS of 0.05% (15th percentile) indicate no observed widespread exploitation at time of analysis.
Verbose error messages in WeGIA versions prior to 3.7.0 expose database-related details through the unauthenticated PHP endpoint `atendido/familiar_docfamiliar.php`, enabling remote attackers to map backend infrastructure and identify further attack vectors. The CVSS 4.0 score of 6.9 reflects network-accessible, zero-authentication exploitation with partial confidentiality impact and no integrity or availability consequence. A proof-of-concept has been identified per SSVC classification, though EPSS sits at just 0.04% (13th percentile), indicating limited broad exploitation interest; no active exploitation has been confirmed via CISA KEV.
Stored XSS in WeGIA versions prior to 3.6.10 allows authenticated high-privilege users to inject malicious JavaScript via the Destinatário field, with payloads persisted and executed when other users view the dispatch page. The vulnerability requires administrative or high-privilege authentication but impacts confidentiality of all users accessing affected pages. No public exploit code or active exploitation has been reported.
Stored Cross-Site Scripting in WeGIA versions prior to 3.6.10 allows authenticated users to inject malicious JavaScript into the Intercorrências notification page, which executes when other users access that page, enabling session hijacking and account takeover. The vulnerability requires user authentication to inject the payload but affects all subsequent viewers of the notification page without additional user interaction. Patch version 3.6.10 resolves the issue.
Open redirect vulnerability in WeGIA web manager prior to version 3.6.9 allows unauthenticated remote attackers to redirect users to arbitrary external URLs by injecting a malicious redirect parameter into HTTP requests. The vulnerability exploits missing URL validation on the redirect parameter, which is passed directly to PHP's header() function without sanitization or whitelist checks. User interaction is required as the victim must click a crafted link, but successful exploitation can facilitate phishing attacks or credential theft by redirecting users to attacker-controlled domains that masquerade as legitimate institutional websites.
Open Redirect vulnerability in WeGIA versions prior to 3.6.9 allows unauthenticated remote attackers to redirect users to arbitrary external websites via the unvalidated nextPage parameter in the /WeGIA/controle/control.php endpoint when combined with specific parameters (metodo=listarTodos and nomeClasse=EstoqueControle). Attackers can exploit the application's trusted domain to conduct phishing attacks, steal credentials, distribute malware, or execute social engineering campaigns. The vulnerability has been patched in version 3.6.9.
Open redirect vulnerability in WeGIA versions prior to 3.6.9 allows unauthenticated remote attackers to redirect users to arbitrary external websites via the nextPage parameter in the /WeGIA/controle/control.php endpoint. By combining this with specific query parameters (metodo=listarTodos, listarId_Nome, nomeClasse=OrigemControle), attackers can leverage the trusted WeGIA domain for phishing, credential harvesting, malware distribution, and social engineering attacks. The vulnerability is fixed in version 3.6.9.
Open redirect in WeGIA web management application versions prior to 3.6.9 allows unauthenticated remote attackers to redirect users to arbitrary external websites via an unvalidated nextPage parameter in the /WeGIA/controle/control.php endpoint. By crafting a malicious URL combining metodo=listarId and nomeClasse=IsaidaControle parameters, attackers can leverage the application's trusted domain for phishing, credential harvesting, malware distribution, and social engineering attacks. The vulnerability is fixed in version 3.6.9.
Open redirect vulnerability in WeGIA web application versions prior to 3.6.9 allows unauthenticated remote attackers to redirect users to arbitrary external URLs via an unvalidated redirect parameter in GET requests. The vulnerability requires user interaction (clicking a malicious link) and has limited confidentiality and integrity impact. This is fixed in version 3.6.9.
Open redirect vulnerability in WeGIA web manager versions prior to 3.6.9 allows unauthenticated remote attackers to redirect users to arbitrary external websites via the unvalidated nextPage parameter in the /WeGIA/controle/control.php endpoint. The vulnerability requires user interaction (clicking a malicious link) but leverages the trusted WeGIA domain to facilitate phishing, credential theft, and malware distribution attacks. This issue is fixed in version 3.6.9.
WeGIA prior to version 3.6.2 lacks framing protection headers (X-Frame-Options and Content-Security-Policy), allowing attackers to perform clickjacking attacks by embedding the application within malicious web pages to trick users into unintended actions. Public exploit code exists for this vulnerability, affecting charitable institutions using vulnerable versions of the web manager.
WeGIA charitable institution management software versions prior to 3.6.2 contain an open redirect vulnerability in the control.php endpoint that fails to validate the nextPage parameter, allowing unauthenticated attackers to redirect users to arbitrary external sites for phishing and credential theft. Public exploit code exists for this vulnerability. The flaw is resolved in version 3.6.2 and later.
WeGIA charitable institution management software versions prior to 3.6.2 contain an open redirect vulnerability in the control.php endpoint that fails to validate the nextPage parameter, allowing attackers to redirect authenticated users to malicious external sites. Public exploit code exists for this vulnerability, which can be leveraged for phishing, credential harvesting, and malware distribution attacks while maintaining the appearance of a trusted WeGIA domain. The vulnerability is resolved in WeGIA 3.6.2 and later versions.
WeGIA versions prior to 3.6.2 contain an open redirect vulnerability in the control.php endpoint that fails to properly validate the nextPage parameter, allowing attackers to redirect authenticated users to malicious external sites. Public exploit code exists for this vulnerability, enabling attackers to conduct phishing campaigns and credential harvesting attacks while leveraging the trust associated with the legitimate WeGIA domain. Update to version 3.6.2 or later to remediate this issue.
WeGIA versions prior to 3.6.2 contain an open redirect vulnerability in the control.php endpoint that fails to validate the nextPage parameter, allowing unauthenticated attackers to redirect users to arbitrary external websites. Public exploit code exists for this vulnerability, which can be leveraged for phishing, credential harvesting, and malware distribution attacks that abuse the trusted WeGIA domain. The vulnerability is resolved in version 3.6.2.
WeGIA prior to version 3.6.2 contains an open redirect vulnerability in the control.php endpoint that fails to validate the nextPage parameter, allowing attackers to craft malicious links redirecting users to arbitrary external sites for phishing and credential theft. Public exploit code exists for this vulnerability, which affects all users who click attacker-controlled links within the application. The vulnerability is resolved in version 3.6.2.
Stored XSS in WeGIA before version 3.6.2 allows authenticated users to inject malicious scripts into adopter information fields that execute in the browsers of all visitors to the affected pages. Public exploit code exists for this vulnerability, which impacts the html/pet/adotantes/cadastro_adotante.php and informacao_adotantes.php endpoints. Organizations should upgrade to version 3.6.2 or later to mitigate the risk of persistent JavaScript injection attacks.
Stored XSS in WeGIA's attendance incident form allows authenticated attackers to inject malicious scripts through unsanitized dropdown fields, affecting versions prior to 3.6.2. An attacker with login credentials can craft payloads that execute in other users' browsers when they view the affected page. Public exploit code exists for this vulnerability, and a patch is available in version 3.6.2 and later.
SQL injection in WeGIA 3.5.4 and earlier allows an authenticated user who holds edit-level permission on the matPat (materials/patrimony) module to execute arbitrary SQL against the backend database via the id_categoria parameter of /html/matPat/editar_categoria.php. Because the endpoint enforces an active session and a resource-22 permission check, exploitation realistically requires a legitimate privileged account or stolen credentials rather than an anonymous remote attacker, although publicly available exploit code exists and the CVSS 4.0 base score of 9.4 reflects full confidentiality, integrity and availability impact on both the vulnerable system and downstream components. The vendor addressed the flaw in WeGIA 3.5.5; EPSS is low at 0.51% (42nd percentile) and there is no indication of confirmed active exploitation in CISA KEV.
Stored cross-site scripting in WeGIA 3.5.4 and earlier allows an authenticated low-privileged user who can create or edit employee records to persist a JavaScript payload that later executes in the browser of any victim - realistically an administrator - who loads /WeGIA/html/geral/configurar_senhas.php and views the unsanitized employee dropdown. Publicly available exploit code exists, but exploitation requires an authenticated account (PR:L) plus victim interaction (UI:R), and the EPSS score of 0.25% (15th percentile) indicates a low likelihood of exploitation, so this is a genuine but moderate-priority issue rather than an emergency. The vendor fixed the defect in version 3.5.5.
Reflected cross-site scripting in WeGIA (Web Manager for Institutions) versions prior to 3.5.1 lets an attacker inject malicious script through the 'action' parameter of the GET endpoint /WeGIA/html/pessoa/editar_info_pessoal.php, which is reflected back without sanitization. Because the flaw is reflected rather than stored, exploitation requires a victim to open an attacker-crafted URL (user interaction), and the injected script then runs in that victim's browser context - meaning impact is limited to the targeted user's session rather than the server. Publicly available exploit code exists and the vendor has confirmed the issue in GitHub advisory GHSA-jmm7-rr7w-f223, but there is no evidence of confirmed active exploitation (not in CISA KEV), and EPSS rates the likelihood of exploitation low at roughly 0.24% (14th percentile); no authentication is required to craft the link (PR:N in the CVSS vector), though meaningful impact depends on targeting an authenticated or active WeGIA user.
Reflected cross-site scripting in WeGIA lets remote, unauthenticated attackers execute arbitrary JavaScript in a victim's browser by supplying a crafted value to the sql parameter of the editar_info_pessoal.php endpoint, and all versions before 3.5.1 are affected. Successful exploitation requires the victim to open an attacker-crafted link, so impact is confined to client-side script execution within the WeGIA origin rather than server-side compromise, matching the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. Publicly available exploit code exists, but EPSS is only 0.29 percent (20th percentile) and there is no confirmed active exploitation (no CISA KEV listing); the vendor-released patch is WeGIA 3.5.1.
An open redirect in WeGIA versions prior to 3.5.0 lets an authenticated low-privilege user redirect victims to arbitrary external domains via the nextPage parameter of the control.php endpoint (metodo=listarTodos, nomeClasse=AlmoxarifeControle). Because the destination is attacker-controlled and only format-validated, the flaw enables phishing, malicious payload delivery, or credential theft against users who click a crafted link; exploitation also requires victim interaction (UI:R) and a valid low-privilege session (PR:L), so it is not an unauthenticated internet-facing redirect. Publicly available exploit code exists, the EPSS score is low at 0.22% (12th percentile), and the issue is confirmed fixed in 3.5.0; it is not listed in CISA KEV, so there is no evidence of active exploitation.
SQL injection in WeGIA prior to 3.5.1 allows an authenticated remote attacker to execute arbitrary SQL statements through the id_dependente POST parameter of the /html/funcionario/dependente_documento.php endpoint, fully compromising the confidentiality, integrity, and availability of the underlying database. The endpoint enforces an authenticated session ($_SESSION['usuario'] plus permissao.php), so valid credentials or a hijacked session are required, but no user interaction or special configuration is needed and the attack complexity is low. Publicly available exploit code exists, including an Exploit-DB entry and GitHub security advisories, and EPSS estimates roughly a 0.9% probability of exploitation in the near term (58th percentile); the vulnerability is fixed in WeGIA 3.5.1.
Reflected cross-site scripting (XSS) in WeGIA versions prior to 3.5.0 lets an attacker inject arbitrary script via the id_pet parameter of /pet/profile_pet.php, causing it to execute in the browser of an authenticated victim who opens a crafted link. Reaching the vulnerable endpoint requires an active authenticated session holding the pet-module permission (permissao($_SESSION['id_pessoa'], 63, 7)), so the attacker needs a victim who is logged in and authorized - the impact is confined to that victim's browser session, with no server-side confidentiality, integrity, or availability loss. Vendor-released patch: 3.5.0; publicly available exploit code exists, but EPSS is only 0.23% (13th percentile) and there is no confirmed active exploitation, making this a moderate-severity, low-priority issue.
Reflected cross-site scripting (XSS) in WeGIA versions prior to 3.5.1 allows unauthenticated attackers to inject arbitrary JavaScript that executes in a victim's browser when the victim opens a crafted link, enabling session theft, credential harvesting, or page defacement within the application's origin. The flaw resides in the base64-decoded 'log' GET parameter processed by html/configuracao/configuracao_geral.php and rendered unescaped inside a <pre> tag via the message helpers in html/geral/msg.php. Publicly available exploit code exists and the vendor has released a fix in 3.5.1; EPSS is low at 0.26% (16th percentile) and there is no confirmed active exploitation (CISA KEV). Exploitation requires user interaction (UI:R) - the victim must follow an attacker-supplied link - so real-world risk is moderate and dependent on social engineering.
SQL injection in WeGIA versions prior to 3.5.1 allows an authenticated attacker with administrative privileges to execute arbitrary SQL statements through the cpf parameter of the /html/funcionario/cadastro_funcionario_pessoa_existente.php endpoint, fully compromising the confidentiality, integrity, and availability of the underlying database. The flaw is rated CVSS 4.0 8.6 (High) and requires a high-privileged session (PR:H), so realistic exploitation is limited to attackers who already hold admin credentials or to insider/privilege-abuse scenarios. Publicly available exploit code exists (referenced via the GitHub security advisory GHSA-x36x-x5j4-wfjf), but EPSS is low at 0.43% (35th percentile) and there is no indication of active exploitation in CISA KEV.
Reflected cross-site scripting in WeGIA versions prior to 3.5.1 lets an authenticated, low-privilege attacker inject script into the idatendido GET parameter of the /html/atendido/cadastro_atendido_parentesco_pessoa_nova.php endpoint, which is echoed unsanitized into a hidden input field and executes in the victim's browser when a crafted link is clicked. Exploitation requires a valid WeGIA session (PR:L) plus victim interaction (UI:R), and impact is limited to the browser context with low confidentiality and integrity effects and no availability impact. The flaw is fixed in WeGIA 3.5.1, publicly available exploit code exists, and EPSS is low at 0.24% (13th percentile) with no indication of confirmed active exploitation.
SQL injection in WeGIA's employee-dependents endpoint (/html/funcionario/dependente_listar.php) lets a logged-in user with access to that feature execute arbitrary SQL against the backend database, compromising the confidentiality, integrity, and availability of stored data. The flaw affects every WeGIA release prior to 3.5.1 and is triggered through the id_funcionario POST parameter; because the endpoint enforces a valid $_SESSION["usuario"] and a permissao.php check, the attack is authenticated (PR:H) rather than unauthenticated. Publicly available exploit code exists and the vendor has shipped a fix in 3.5.1, but EPSS is low (0.53%, 43rd percentile) and there is no confirmed active exploitation (no CISA KEV listing).
Unauthenticated information disclosure in WeGIA 3.4.12 and earlier allows remote attackers to retrieve sensitive personal and financial records of members simply by requesting the /html/socio/sistema/get_relatorios_socios.php endpoint, which prior to version 3.5.0 performs no session or permission validation before returning query results. The flaw is a broken access control issue (CWE-200) with a CVSS v4.0 base score of 8.7 and high confidentiality impact, and the CVSS vector (PR:N) confirms exploitation requires no authentication. Publicly available exploit code exists, but EPSS is low at 0.17% (38th percentile) and there is no confirmation of active exploitation in CISA KEV; the vendor-released fix is version 3.5.0.
Open redirect in WeGIA 3.4.12 and earlier lets an authenticated attacker craft a link to the control.php endpoint (metodo=listarUm&nomeClasse=FuncionarioControle) whose unsanitised nextPage parameter is reflected directly into an HTTP Location header, sending a victim who clicks it to any external domain the attacker chooses. The CVSS vector (PR:L, UI:A) confirms a valid WeGIA session context is required and that the victim must actively click the crafted link, so the practical impact is limited to phishing-style abuse - credential theft or delivery of malicious payloads under the trusted institution's domain - rather than server compromise. Publicly available exploit code exists (the vendor's own GHSA-m64v-hm7q-33wr advisory) and EPSS is only 0.04% (10th percentile); there is no CISA KEV listing, and the independent assessment rates this a genuinely low-priority, real-world-low-risk issue despite the MEDIUM CVSS of 4.8. The vulnerability is fixed in WeGIA 3.5.0.
SQL injection in the WeGIA web manager (versions 3.4.12 and below) lets an authenticated user who holds the pet-module permission execute arbitrary SQL against the backend MySQL database via the id_pet parameter of /pet/profile_pet.php, compromising confidentiality, integrity and availability of stored data. Publicly available exploit code exists, although EPSS is low at 0.04% (14th percentile) and the vulnerability is not listed in CISA KEV, so confirmed active exploitation has not been observed and the practical risk is gated by the requirement for a valid, low-privileged WeGIA session with access to the pet profile feature. The issue is fixed in version 3.5.0.
WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Cross-Site Request Forgery (CSRF) vulnerability. The delete operation for the Almoxarifado entity is exposed via HTTP GET without CSRF protection, allowing a third-party site to trigger the action using the victim’s authenticated session. This issue is fixed in version 3.5.0.
Authenticated SQL injection in WeGIA 3.4.12 and earlier allows a logged-in user to execute arbitrary SQL statements through the descricao parameter handled by the /controle/control.php endpoint, compromising the confidentiality, integrity, and availability of the underlying database. Exploitation requires a valid WeGIA session with access to the product-registration workflow (assessed vector PR:L, network reachable, no user interaction), and publicly available exploit code exists, although EPSS is only 0.03% (9th percentile), indicating limited observed activity so far. The vendor addressed the flaw in version 3.5.0 by sanitizing product input and replacing the concatenated query with a PDO prepared statement.
WeGIA is a Web manager for charitable institutions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Remote code execution in WeGIA allows an authenticated low-privileged user to upload a PHP webshell through the Excel-import endpoint /html/socio/sistema/controller/controla_xlsx.php by prepending Excel magic bytes to a PHP file, defeating the endpoint's MIME-type-only check. Versions before 3.4.11 are affected, and the 3.4.11 release contains the complete fix for this incomplete remediation of CVE-2025-22133. Publicly available exploit code exists, while EPSS is 0.22% (44th percentile), indicating low predicted exploitation likelihood.
WeGIA is a Web manager for charitable institutions. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WeGIA is a Web manager for charitable institutions. Rated high severity (CVSS 8.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WeGIA is a Web manager for charitable institutions. Rated low severity (CVSS 2.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Authenticated remote code execution in WeGIA prior to 3.4.11 lets a low-privilege user upload a spreadsheet carrying trailing PHP code under an attacker-controlled .php filename, which the application writes to a web-accessible location and executes. The flaw is an incomplete fix for CVE-2025-22133, requires PR:L credentials and access to the upload feature, and is not exploitable by unauthenticated users. Publicly available exploit code exists; EPSS is 0.65% (71st percentile), so prioritization should focus on exposed WeGIA deployments that permit low-privilege uploads.
WeGIA is a Web manager for charitable institutions. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
WeGIA is a Web manager for charitable institutions. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
WeGIA is a Web manager for charitable institutions. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
WeGIA is a Web manager for charitable institutions. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
WeGIA is a Web manager for charitable institutions. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the editar_permissoes.php endpoint of the WeGIA application prior to version 3.4.4. This vulnerability allows attackers to inject malicious scripts in the msg_c parameter. Version 3.4.4 fixes the issue.
WeGIA versions prior to 3.4.5 contain a SQL Injection vulnerability in the member deletion endpoint that allows authenticated users to execute arbitrary SQL commands via the `id_socio` parameter. This high-severity vulnerability (CVSS 8.8) compromises the confidentiality, integrity, and availability of the entire database. The vulnerability requires valid credentials to exploit but offers complete database compromise once authenticated.
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `relatorio_geracao.php` endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject malicious scripts in the `tipo_relatorio` parameter. Version 3.4.5 has a patch for the issue.
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. An Open Redirect vulnerability exists in the web application prior to version 3.4.5. The control.php endpoint allows to specify an arbitrary URL via the `nextPage` parameter, leading to an uncontrolled redirection. Version 3.4.5 contains a fix for the issue.
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the `index.php` endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject malicious scripts in the `erro` parameter. Version 3.4.5 contains a patch for the issue.
WeGIA is a web manager for charitable institutions. The Wegia server has a vulnerability that allows excessively long HTTP GET requests to a specific URL. This issue arises from the lack of validation for the length of the fid parameter. Tests confirmed that the server processes URLs up to 8,142 characters, resulting in high resource consumption, elevated latency, timeouts, and read errors. This makes the server susceptible to Denial of Service (DoS) attacks. This vulnerability is fixed in 3.3.0.
WeGIA is a web manager for charitable institutions. The Wegia server has a vulnerability that allows excessively long HTTP GET requests to a specific URL. This issue arises from the lack of validation for the length of the errorstr parameter. Tests confirmed that the server processes URLs up to 8,142 characters, resulting in high resource consumption, elevated latency, timeouts, and read errors. This makes the server susceptible to Denial of Service (DoS) attacks. This vulnerability is fixed in 3.3.0.
WeGIA is a web manager for charitable institutions. An SQL Injection vulnerability was identified in the /html/funcionario/profile_funcionario.php endpoint. The id_funcionario parameter is not properly sanitized or validated before being used in a SQL query, allowing an unauthenticated attacker to inject arbitrary SQL commands. The vulnerability is fixed in 3.4.3.
WeGIA is a web manager for charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in the almox parameter of the /controle/relatorio_geracao.php endpoint. This issue allows attacker to inject arbitrary SQL queries, potentially leading to unauthorized data access or further exploitation depending on database configuration. This vulnerability is fixed in 3.4.1.
WeGIA is a web manager for charitable institutions. An XSS Injection vulnerability was identified in novo_memorando.php. After the memo was submitted, the vulnerability was confirmed by accessing listar_memorandos_antigos.php. Upon loading this page, the injected script was executed in the browser. This vulnerability is fixed in 3.4.3.
WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the profile_familiar.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the id_dependente parameter. This vulnerability is fixed in 3.4.3.
WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the cadastro_dependente_pessoa_nova.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the id_funcionario parameter. This vulnerability is fixed in 3.4.3.
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in version 3.3.3 the almox parameter of the `/controle/getProdutosPorAlmox.php` endpoint. This issue allows any unauthenticated attacker to inject arbitrary SQL queries, potentially leading to unauthorized data access or further exploitation depending on database configuration. Version 3.4.0 fixes the issue.
Cross-site scripting in WeGIA 3.4.0 allows remote attackers with low privileges to inject scripts via employee registration form fields. A proof-of-concept exploit is publicly available, but no active exploitation has been confirmed. The vendor did not respond to disclosure, leaving the vulnerability unpatched.
Cross-site scripting in WeGIA 3.4.0 allows a remote authenticated low-privileged attacker to inject arbitrary web script via the 'Insira o novo tipo' parameter in the adicionar_tipoSaida.php page. Successful exploitation requires user interaction and can lead to session hijacking or unauthorized actions on behalf of the victim. Public exploit code exists but no active widespread exploitation has been reported.