WeGIA < 3.6.5 - Unauthenticated Authentication Bypass via extract()

WeGIA 3.6.5 contains an authentication bypass caused by unsafe use of extract on $REQUEST, letting unauthenticated attackers bypass authentication and access protected areas, exploit requires no authentication. id: CVE-2026-28411 info: name: WeGIA 3.6.5 - Unauthenticated Authentication Bypass via...

WeGIA <= 3.6.4 - Remote Code Execution

WeGIA = 3.6.5 contains a remote code execution caused by improper validation of backup file names in the database restoration functionality, letting attackers with administrative access execute arbitrary OS commands id: CVE-2026-28409 info: name: WeGIA = 3.6.4 - Remote Code Execution author:...

CVE-2026-23723-POC

CVE-2026-23723 PoC - WeGIA Authenticated SQL Injection Exploit Helper Authenticated Error-Based SQL Injection in WeGIA ≤ 3.6.1 GHSA-xfmp-2hf9-gfjp | Official Advisory POC Original Author / Reporter : ViniCastro2001 GHSA Published by : nilsonLazarin project maintainer This lightweight Python scrip...

CVE-2026-61719

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in saude/historicoprontuarios.php arises because the textoProntuario field accepts arbitrary HTML or JavaScript without proper sanitization. An attacker able to create or access a...

CVE-2026-61671

WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the /controle/control.php dispatch endpoint accepts attacker-controlled nomeClasse, metodo, and record identifier parameters through extract$REQUEST, including id, idatendido, idInterno, and...

CVE-2026-61673

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in web/html/memorando/listardespachos.php results from unsafe handling of the texto field. The affected flow spans web/controle/memorando/DespachoControle.php and...

CVE-2026-61719 WeGIA: Stored Cross-Site Scripting (XSS) in "historico_prontuarios.php" via "textoProntuario" Field

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in saude/historicoprontuarios.php arises because the textoProntuario field accepts arbitrary HTML or JavaScript without proper sanitization. An attacker able to create or access a...

CVE-2026-61719 WeGIA: Stored Cross-Site Scripting (XSS) in "historico_prontuarios.php" via "textoProntuario" Field

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in saude/historicoprontuarios.php arises because the textoProntuario field accepts arbitrary HTML or JavaScript without proper sanitization. An attacker able to create or access a...

EUVD-2026-113400

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in saude/historicoprontuarios.php arises because the textoProntuario field accepts arbitrary HTML or JavaScript without proper sanitization. An attacker able to create or access a...

CVE-2026-61719

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in "saude/historicoprontuarios.php" arises because the "textoProntuario" field accepts arbitrary HTML or JavaScript without proper sanitization. An attacker able to create or access a...

CVE-2026-61719

Prior to version 3.8.7 , the WeGIA web manager for charitable institutions is vulnerable to stored cross-site scripting (XSS) . The root cause is the lack of proper sanitization in the textoProntuario field within saude/historico_prontuarios.php. An attacker with permissions to create or access p...

CVE-2026-61673

Prior to version 3.8.7 , the web manager WeGIA for charitable institutions is vulnerable to a stored DOM cross-site scripting (XSS) vulnerability in web/html/memorando/listar_despachos.php. The root cause is the unsafe handling of the texto field: while FILTER_SANITIZE_SPECIAL_CHARS is applied du...

CVE-2026-61673 WeGIA: Stored DOM XSS in listar_despachos.php Allows Account Takeover

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in web/html/memorando/listardespachos.php results from unsafe handling of the texto field. The affected flow spans web/controle/memorando/DespachoControle.php and...

CVE-2026-61673 WeGIA: Stored DOM XSS in listar_despachos.php Allows Account Takeover

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in web/html/memorando/listardespachos.php results from unsafe handling of the texto field. The affected flow spans web/controle/memorando/DespachoControle.php and...

EUVD-2026-113398

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in web/html/memorando/listardespachos.php results from unsafe handling of the texto field. The affected flow spans web/controle/memorando/DespachoControle.php and...

CVE-2026-61673

WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in "web/html/memorando/listardespachos.php" results from unsafe handling of the "texto" field. The affected flow spans "web/controle/memorando/DespachoControle.php" and...

EUVD-2026-113397

WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the /controle/control.php dispatch endpoint accepts attacker-controlled nomeClasse, metodo, and record identifier parameters through extract$REQUEST, including id, idatendido, idInterno, and...

CVE-2026-61671

WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the "/controle/control.php" dispatch endpoint accepts attacker-controlled "nomeClasse", "metodo", and record identifier parameters through "extract$REQUEST", including id, "idatendido",...

CVE-2026-61671 WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes

WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the /controle/control.php dispatch endpoint accepts attacker-controlled nomeClasse, metodo, and record identifier parameters through extract$REQUEST, including id, idatendido, idInterno, and...

CVE-2026-61671 WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes

WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the /controle/control.php dispatch endpoint accepts attacker-controlled nomeClasse, metodo, and record identifier parameters through extract$REQUEST, including id, idatendido, idInterno, and...