CVE-2025-55171

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, the application does not check authentication at endpoint /html/personalizacaoremover.php allowing anonymous attacker without login to delete any Image files at endpoin...

CVE-2025-55170

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a reflected cross-site scripting XSS vulnerability was identified in the /html/alterarsenha.php endpoint of the WeGIA application. This vulnerability allows attackers t...

CVE-2025-55170

WeGIA prior to 3.4.8 contains a reflected XSS vulnerability in /html/alterar_senha.php via verificacao and redir_config parameters. The issue is patched in version 3.4.8. Exploitation details are not provided in the connected documents; remediation is to upgrade to 3.4.8 or later.

CVE-2025-55168

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a SQL Injection vulnerability was identified in the /html/saude/aplicarmedicamento.php endpoint, specifically in the idfichamedica parameter. This vulnerability allows...

CVE-2025-55168 WeGIA SQL Injection via id_fichamedica at endpoint `GET /html/saude/aplicar_medicamento.php`

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a SQL Injection vulnerability was identified in the /html/saude/aplicarmedicamento.php endpoint, specifically in the idfichamedica parameter. This vulnerability allows...

CVE-2025-55168

CVE-2025-55168 affects WeGIA prior to 3.4.8, where a SQL injection exists in the GET endpoint /html/saude/aplicar_medicamento.php via the id_fichamedica parameter. This allows attackers to execute arbitrary SQL commands, risking confidentiality, integrity, and availability of the database. The is...

CVE-2025-55167

CVE-2025-55167 affects WeGIA prior to 3.4.8. A SQL Injection vulnerability exists in the endpoint /html/funcionario/dependente_remover.php, taking the id_dependente parameter, allowing an attacker to execute arbitrary SQL commands. Impact is described as compromising confidentiality, integrity, a...

PT-2025-32895 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.8 Description: WeGIA is a web manager with a focus on the Portuguese language and charitable institutions. A reflected cross-site scripting XSS vulnerability exists in the /html/alterar senha.php API endpoint...

The vulnerability of the WeGIA web manager’s personalizacao_imagem.php script allows attackers to perform cross-site scripting (XSS) attacks.

The vulnerability of the personalizacaoimagem.php web handler of the WeGIA browser is related to the failure to protect the website structure when processing the err parameter. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

The vulnerability in the WeGIA web manager’s script /html/funcionario/dependente_editarInfoPessoal.php allows a perpetrator to disclose confidential information, increase their privileges, or execute arbitrary code.

The vulnerability of the WeGIA web manager’s script /html/funcionario/dependenteeditarInfoPessoal.php is related to the lack of protection for the SQL query structure during the processing of the parameter idatendidofamiliares. Exploiting this vulnerability can allow an attacker to disclose...

The vulnerability in the WeGIA web manager’s script /html/funcionario/dependente_editarEndereco.php allows a perpetrator to disclose confidential information, increase their privileges, or execute arbitrary code.

The vulnerability in the WeGIA web manager’s script /html/funcionario/dependenteeditarEndereco.php relates to the failure to protect the SQL query structure when processing the parameter idatendidofamiliares. Exploiting this vulnerability can allow an attacker to disclose confidential information...

The vulnerability in the WeGIA web manager’s script pre_cadastro_atendido.php allows a violator to perform cross-site scripting attacks.

The vulnerability in the WeGIA web manager’s script precadastroatendido.php is related to insufficient protection of the website structure when processing the msge parameter. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

The vulnerability of the personalizacao.php script of the WeGIA web manager allows attackers to perform cross-site scripting attacks.

The vulnerability of the personalizacao.php script of the WeGIA web manager is related to the failure to protect the structure of the web page when processing the err parameter. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

The vulnerability in the WeGIA web manager’s /html/funcionario/profile_dependente.php script allows a perpetrator to disclose confidential information, increase their privileges, or execute arbitrary code.

The vulnerability in the WeGIA web manager’s /html/funcionario/profiledependente.php script relates to the failure to protect the SQL query structure when processing the iddependente parameter. Exploiting this vulnerability can allow an attacker to disclose confidential information, enhance their...

The vulnerability in the WeGIA web manager’s script /html/funcionario/dependente_editarDoc.php allows a perpetrator to disclose confidential information, increase their privileges, or execute arbitrary code.

The vulnerability of the /html/funcionario/dependenteeditarDoc.php web manager of WeGIA is related to the failure to protect the SQL query structure when processing the parameter idatendidofamiliares. Exploiting this vulnerability can allow an attacker to disclose confidential information, enhanc...

The vulnerability of the /html/atendido/Profile_Atendido.php script of the WeGIA web manager allows a perpetrator to disclose confidential information or cause service denial.

The vulnerability of the WeGIA web manager’s /html/atendido/ProfileAtendido.php script is related to the failure to protect the SQL query structure when processing the idatendido parameter. Exploiting this vulnerability can allow an attacker to disclose confidential information or cause service...

The vulnerability of the WeGIA web manager, related to the failure to protect the SQL query structure, allows attackers to execute arbitrary SQL code.

The vulnerability of the WeGIA web manager is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL code remotely...

The vulnerability of the WeGIA web manager for charitable organizations stems from the failure to implement measures to protect the SQL query structure, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the WeGIA web manager for charitable organizations is related to the failure to implement measures to protect the SQL query structure when processing the id parameter. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to...

The vulnerability of the WeGIA web manager, related to the failure to protect the SQL query structure, allows attackers to execute arbitrary SQL code.

The vulnerability of the WeGIA web manager is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL code remotely...

The vulnerability of the WeGIA web manager, related to the failure to protect the structure of web pages, allows attackers to perform cross-site scripting attacks.

The vulnerability of the WeGIA web manager is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...