CVE-2026-61671

WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the /controle/control.php dispatch endpoint accepts attacker-controlled nomeClasse, metodo, and record identifier parameters through extract$REQUEST, including id, idatendido, idInterno, and...

CVE-2026-61671

WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the "/controle/control.php" dispatch endpoint accepts attacker-controlled "nomeClasse", "metodo", and record identifier parameters through "extract$REQUEST", including id, "idatendido",...

CVE-2026-61671: LabRedesCefetRJ WeGIA: WeGIA is a web manager for charitable institutions

WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the /controle/control.php dispatch endpoint accepts attacker-controlled nomeClasse, metodo, and record identifier parameters through extract$REQUEST, including id, idatendido, idInterno, and...

CVE-2026-97685

In LimeSurvey Community Edition 7.3.0 , an authenticated user with survey creation privileges can perform a cross-survey object authorization bypass via the REST survey-patching endpoint . While the endpoint correctly validates permissions against the survey ID in the URL, the underlying persiste...

PT-2026-81000

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 24.0.0 Description A broken object-level authorization issue exists in the REST API third-party site account write routes. Authenticated attackers with third-party creation rights can bypass per-object access checks,...