LLabRedesCefetRJ

Products

Exploited and recent CVEs

• CVE-2026-61719 High 8.9 WeGIA: Stored Cross-Site Scripting (XSS) in "historico_prontuarios.php" via "textoProntuario" Field 0.2%
• CVE-2026-61673 Medium 6.3 WeGIA: Stored DOM XSS in listar_despachos.php Allows Account Takeover 0.3%
• CVE-2026-61671 High 8.1 WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes 0.2%
• CVE-2026-55684 Critical 9.8 WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php 0.5%
• CVE-2026-55682 High 8.1 WeGIA: Session Fixation via User-Controlled PHPSESSID Cookie + DB_HOST Leak in html/seguranca/sessionStart.php 0.4%
• CVE-2026-55681 High 8.8 WeGIA: SQL Injection in html/matPat/restaurar_produto_desocultar.php via id_produto parameter 0.6%
• CVE-2026-55679 Medium 6.5 WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection 0.5%
• CVE-2026-55680 Critical 9.8 WeGIA: Unauthenticated SQL Injection in cadastro_cobranca.php via "codigo" parameter 0.5%
• CVE-2026-55683 Critical 9.8 WeGIA: SQL Injection in html/socio/sistema/cadastro_cobranca.php 0.6%
• CVE-2026-54767 Critical 9.1 WeGIA: Hardcoded Secret Key Backdoor — Mass Data Destruction via deletar_socios.php 0.8%
• CVE-2026-54671 High 8.8 WeGIA: Authorization Bypass via Empty Resource Array in InternoControle 0.6%
• CVE-2026-54670 Critical 9.1 WeGIA: Unauthenticated Auth Bypass + Local File Inclusion 0.8%
• CVE-2026-76634 Medium 6.5 WeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.php 0.4%
• CVE-2026-76633 High 8.1 WeGIA < 3.9.2 Authorization Bypass Password Change via alterarSenha 0.4%
• CVE-2026-45335 Medium 5.4 WeGIA: Middleware whitelist bypass → open redirect via InternoControle.nextPage 0.2%
• CVE-2026-45027 Medium 5.9 WeGIA: Use of Weak Password Hashing Algorithm (SHA-256, no salt) in html/login.php 0.2%
• CVE-2026-45026 Medium 6.8 WeGIA: Stored XSS in html/atendido/processo_aceitacao.php 0.3%
• CVE-2026-45025 Medium 6.8 WeGIA: Stored XSS in html/atendido/etapa_processo.php 0.3%
• CVE-2026-42873 None 0.0 WeGIA: Error Handling Upload DocDependente 0.2%
• CVE-2026-42872 Medium 6.1 WeGIA: Reflected XSS in listar_arquivos_etapa.php 0.2%
• CVE-2026-42870 Medium 6.4 WeGIA: Cross-Site Scripting (XSS) Stored endpoint 'informacao_adicional.php' parameter 'descricao' 0.4%
• CVE-2026-42871 Medium 6.9 WeGIA: Error Handling familiar_docfamiliar 0.3%
• CVE-2026-40286 High 7.5 WeGIA has Cross-Site Scripting in Controle de Contribuição 0.2%
• CVE-2026-40285 High 8.8 WeGIA has SQL Injection via Session Variable Override in DespachoControle.php 0.3%
• CVE-2026-40284 Medium 6.8 WeGIA has stored XSS in listar_despachos.php 0.2%
• CVE-2026-40282 Medium 6.4 WeGIA has stored XSS in intercorrencia_visualizar.php 0.3%
• CVE-2026-40283 Medium 6.8 WeGIA has stored XSS in profile_paciente.php 0.2%
• CVE-2026-35475 Medium 5.1 WeGIA - Open Redirect - backup redirection — Unvalidated $_GET['redirect'] 0.2%
• CVE-2026-35474 Medium 5.1 WeGIA - Open Redirect - atualizacao redirection - Unvalidated $_GET['redirect'] 0.2%
• CVE-2026-35473 Medium 6.1 WeGIA - Open Redirect - IentradaControle - listarId() - Unvalidated $_GET['nextPage'] 0.2%