CVE-2026-40283

CVE-2026-40283 (WeGIA) describes a stored XSS in the WeGIA web manager for charitable institutions. In versions prior to 3.6.10, an authenticated user can inject JavaScript via the Nome field on the Informações Pacientes page; the payload is stored and executed when the patient information is vie...

CVE-2025-53946 WeGIA vulnerable to SQL Injection in endpoint profile_paciente.php parameter id_fichamedica

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.4.5 in the idfuncionario parameter of the /html/saude/profilepaciente.php endpoint. This vulnerability allows attacker to...

CVE-2025-53946

WeGIA (open source web manager for welfare organizations) has a SQL Injection vulnerability in versions prior to 3.4.5, arising from unsafely handling the id_funcionario parameter in the /html/saude/profile_paciente.php endpoint. An attacker could manipulate SQL queries to reveal sensitive databa...