17 matches found
PT-2026-95158
Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.8.5 Description An authorization bypass exists where the software maps InternoControle to an empty resource array in the 'web/controle/control.php' endpoint. The verificarPermissao function in...
CVE-2026-54671: Authorization Bypass Through User-Controlled Key
WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and verificarPermissao in web/dao/MiddlewareDAO.php treats that empty array as unconditional access for every authenticated user. The methods in...
CVE-2026-76633 WeGIA < 3.9.2 Authorization Bypass Password Change via alterarSenha
WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of the alterarSenha method from permission checks in...
CVE-2026-76633 WeGIA < 3.9.2 Authorization Bypass Password Change via alterarSenha
WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of the alterarSenha method from permission checks in...
CVE-2026-76633 WeGIA < 3.9.2 Authorization Bypass Password Change via alterarSenha
WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of the alterarSenha method from permission checks in...
CVE-2026-76633: Missing Authorization
WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of the alterarSenha method from permission checks in...
PT-2026-79005
WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of the alterarSenha method from permission checks in...
CVE-2026-35473: URL Redirection to Untrusted Site
WeGIA is a Web manager for charitable institutions. Prior to 3.6.9, an Open Redirect vulnerability was identified in the /WeGIA/controle/control.php endpoint of the WeGIA application, specifically through the nextPage parameter when combined with metodo=listarId and nomeClasse=IentradaControle. T...
CVE-2025-61603: Improper Neutralization of Special Elements used in an SQL Command
WeGIA is a Web manager for charitable institutions. Versions 3.4.12 and below include an SQL Injection vulnerability which was identified in the /controle/control.php endpoint, specifically in the descricao parameter. This vulnerability allows attackers to execute arbitrary SQL commands,...
CVE-2025-53937
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in the "/controle/control.php" endpoint, specifically in the "cargo" parameter, of WeGIA prior to version 3.4.5. This vulnerability allows attacker...
CVE-2025-53937: Improper Neutralization of Special Elements used in an SQL Command
WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in the /controle/control.php endpoint, specifically in the cargo parameter, of WeGIA prior to version 3.4.5. This vulnerability allows attackers to...
CVE-2025-52474: Improper Neutralization of Special Elements used in an SQL Command
WeGIA is a web manager for charitable institutions. Prior to version 3.4.2, a SQL Injection vulnerability was identified in the id parameter of the /WeGIA/controle/control.php endpoint. This vulnerability allows attacker to manipulate SQL queries and access sensitive database information, such as...
CVE-2025-30367
WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.2.6 in the nextPage parameter of the /WeGIA/controle/control.php endpoint. This vulnerability allows attacker to manipulate SQL queries and access sensitive database information...
PT-2025-3396
Name of the Vulnerable Software and Affected Versions WeGIA version 3.2.0 Description The issue concerns a SQL Injection vulnerability. It can be exploited through the nextPage parameter in the "/controle/control.php" API endpoint. Recommendations For WeGIA version 3.2.0, consider disabling the...
CVE-2024-57032: Incorrect Authorization
WeGIA 3.2.0 is vulnerable to Incorrect Access Control in controle/control.php. The application does not validate the value of the old password, so it is possible to change the password by placing any value in the senhaantiga field...
CVE-2024-57032
WeGIA 3.2.0 is vulnerable to Incorrect Access Control in controle/control.php. The application does not validate the value of the old password, so it is possible to change the password by placing any value in the senhaantiga field...