Vulnerability · Published May 11, 2026 · Assigned by GitHub_M

CVE-2026-42873WeGIA: Error Handling Upload DocDependente

None 0.0

In plain English

A information exposure in WeGIA from LabRedesCefetRJ. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)0.0None

Exploit odds (30 days)0.2%top 85.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, when attempting to upload a file with malicious content to funcionario/docdependente_upload.php, the application responds with an overly descriptive error message. This leads to information disclosure, effectively increasing the attack surface by providing potential attackers with technical insights to refine their exploits. This vulnerability is fixed in 3.6.10.

Affected products (as reported)

Vendor	Product	Versions
LabRedesCefetRJ	WeGIA	< 3.6.10

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N

References

https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-mwc9-45h6-pw24 x_refsource_CONFIRM