LabRedesCefetRJ WeGIA

• CVE-2026-61719 High 8.9 WeGIA: Stored Cross-Site Scripting (XSS) in "historico_prontuarios.php" via "textoProntuario" Field 0.2%
• CVE-2026-61673 Medium 6.3 WeGIA: Stored DOM XSS in listar_despachos.php Allows Account Takeover 0.3%
• CVE-2026-61671 High 8.1 WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes 0.2%
• CVE-2026-55684 Critical 9.8 WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php 0.5%
• CVE-2026-55682 High 8.1 WeGIA: Session Fixation via User-Controlled PHPSESSID Cookie + DB_HOST Leak in html/seguranca/sessionStart.php 0.4%
• CVE-2026-55681 High 8.8 WeGIA: SQL Injection in html/matPat/restaurar_produto_desocultar.php via id_produto parameter 0.6%
• CVE-2026-55679 Medium 6.5 WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection 0.5%
• CVE-2026-55680 Critical 9.8 WeGIA: Unauthenticated SQL Injection in cadastro_cobranca.php via "codigo" parameter 0.5%
• CVE-2026-55683 Critical 9.8 WeGIA: SQL Injection in html/socio/sistema/cadastro_cobranca.php 0.6%
• CVE-2026-54767 Critical 9.1 WeGIA: Hardcoded Secret Key Backdoor — Mass Data Destruction via deletar_socios.php 0.8%
• CVE-2026-54671 High 8.8 WeGIA: Authorization Bypass via Empty Resource Array in InternoControle 0.6%
• CVE-2026-54670 Critical 9.1 WeGIA: Unauthenticated Auth Bypass + Local File Inclusion 0.8%
• CVE-2026-76634 Medium 6.5 WeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.php 0.4%
• CVE-2026-76633 High 8.1 WeGIA < 3.9.2 Authorization Bypass Password Change via alterarSenha 0.4%
• CVE-2026-45335 Medium 5.4 WeGIA: Middleware whitelist bypass → open redirect via InternoControle.nextPage 0.2%
• CVE-2026-45027 Medium 5.9 WeGIA: Use of Weak Password Hashing Algorithm (SHA-256, no salt) in html/login.php 0.2%
• CVE-2026-45026 Medium 6.8 WeGIA: Stored XSS in html/atendido/processo_aceitacao.php 0.3%
• CVE-2026-45025 Medium 6.8 WeGIA: Stored XSS in html/atendido/etapa_processo.php 0.3%
• CVE-2026-42873 None 0.0 WeGIA: Error Handling Upload DocDependente 0.2%
• CVE-2026-42872 Medium 6.1 WeGIA: Reflected XSS in listar_arquivos_etapa.php 0.2%
• CVE-2026-42870 Medium 6.4 WeGIA: Cross-Site Scripting (XSS) Stored endpoint 'informacao_adicional.php' parameter 'descricao' 0.4%
• CVE-2026-42871 Medium 6.9 WeGIA: Error Handling familiar_docfamiliar 0.3%
• CVE-2026-40286 High 7.5 WeGIA has Cross-Site Scripting in Controle de Contribuição 0.2%
• CVE-2026-40285 High 8.8 WeGIA has SQL Injection via Session Variable Override in DespachoControle.php 0.3%
• CVE-2026-40284 Medium 6.8 WeGIA has stored XSS in listar_despachos.php 0.2%
• CVE-2026-40282 Medium 6.4 WeGIA has stored XSS in intercorrencia_visualizar.php 0.3%
• CVE-2026-40283 Medium 6.8 WeGIA has stored XSS in profile_paciente.php 0.2%
• CVE-2026-35475 Medium 5.1 WeGIA - Open Redirect - backup redirection — Unvalidated $_GET['redirect'] 0.2%
• CVE-2026-35474 Medium 5.1 WeGIA - Open Redirect - atualizacao redirection - Unvalidated $_GET['redirect'] 0.2%
• CVE-2026-35473 Medium 6.1 WeGIA - Open Redirect - IentradaControle - listarId() - Unvalidated $_GET['nextPage'] 0.2%
• CVE-2026-35399 High 8.5 WeGIA has Stored XSS in backup file names 0.3%
• CVE-2026-35472 Medium 5.1 WeGIA - Open Redirect - EstoqueControle - listarTodos() - Unvalidated $_GET['nextPage'] 0.2%
• CVE-2026-35398 Medium 6.1 WeGIA - Open Redirect - OrigemControle - listarTodos() & listarId_Nome() - Unvalidated $_GET['nextPage'] 0.2%
• CVE-2026-35396 Medium 5.1 WeGIA - Open Redirect - IsaidaControle - listarId() - Unvalidated $_GET['nextPage'] 0.2%
• CVE-2026-35395 High 8.8 WeGIA has a SQL Injection in DespachoDAO.php via id_memorando parameter 0.4%
• CVE-2026-33991 High 8.8 WeGIA has SQL Injection in deletar_tag.php 0.4%
• CVE-2026-33136 Critical 9.3 WeGIA has Reflected Cross-Site Scripting (XSS) in `listar_memorandos_ativos.php` via `sccd` parameter 0.2%
• CVE-2026-33135 Critical 9.3 WeGIA has Reflected Cross-Site Scripting (XSS) in `novo_memorandoo.php` via `sccs` parameter 0.2%
• CVE-2026-33134 Critical 9.3 WeGIA has Authenticated Time-Based Blind SQL Injection in `restaurar_produto.php` via `id_produto` parameter 0.3%
• CVE-2026-33133 High 8.6 WeGIA has an arbitrary SQL execution vulnerability via crafted backup archive 0.4%
• CVE-2026-31896 Critical 9.8 WeGIA has a Time-Based Blind SQL Injection in remover_produto_ocultar.php 0.4%
• CVE-2026-31895 High 8.8 WeGIA has a SQL Injection via Direct Query Interpolation in restaurar_produto.php 0.4%
• CVE-2026-31894 Medium 6.9 WeGIA affected by arbitrary file read via symlink in backup restore 0.5%
• CVE-2026-28411 Critical 9.8 WeGIA Vulnerable to Authentication Bypass via `extract($_REQUEST)` 2.7%
• CVE-2026-28409 Critical 10.0 WeGIA Vulnerable to Remote Code Execution (RCE) via OS Command Injection 3.6%
• CVE-2026-28408 Critical 9.8 WeGIA lacks authentication verification in adicionar_tipo_docs_atendido.php 0.6%
• CVE-2026-23731 Medium 4.3 WeGIA Clickjacking Vulnerability 0.3%
• CVE-2026-23730 Medium 4.8 WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=ProdutoControle) 0.2%
• CVE-2026-23729 Medium 4.8 WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarDescricao, nomeClasse=ProdutoControle) 0.2%
• CVE-2026-23728 Medium 4.8 WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=DestinoControle) 0.2%