# LabRedesCefetRJ WeGIA.

Every CVE that names LabRedesCefetRJ WeGIA among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [WeGIA: Stored Cross-Site Scripting (XSS) in "historico_prontuarios.php" via "textoProntuario" Field](https://agentprime.io/advisories/CVE-2026-61719.md)
  `CVE-2026-61719` · CVE record: LabRedesCefetRJ WeGIA · CVSS 8.9 High · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WeGIA: Stored DOM XSS in listar_despachos.php Allows Account Takeover](https://agentprime.io/advisories/CVE-2026-61673.md)
  `CVE-2026-61673` · CVE record: LabRedesCefetRJ WeGIA · CVSS 6.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site scripting (XSS)
- [WeGIA: Systemic IDOR + Missing CSRF — extract($\_REQUEST) in All Controle Classes](https://agentprime.io/advisories/CVE-2026-61671.md)
  `CVE-2026-61671` · CVE record: LabRedesCefetRJ WeGIA · CVSS 8.1 High · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php](https://agentprime.io/advisories/CVE-2026-55684.md)
  `CVE-2026-55684` · CVE record: LabRedesCefetRJ WeGIA · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection
- [WeGIA: Session Fixation via User-Controlled PHPSESSID Cookie + DB_HOST Leak in html/seguranca/sessionStart.php](https://agentprime.io/advisories/CVE-2026-55682.md)
  `CVE-2026-55682` · CVE record: LabRedesCefetRJ WeGIA · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure, Authentication bypass
- [WeGIA: SQL Injection in html/matPat/restaurar_produto_desocultar.php via id_produto parameter](https://agentprime.io/advisories/CVE-2026-55681.md)
  `CVE-2026-55681` · CVE record: LabRedesCefetRJ WeGIA · CVSS 8.8 High · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection
- [WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection](https://agentprime.io/advisories/CVE-2026-55679.md)
  `CVE-2026-55679` · CVE record: LabRedesCefetRJ WeGIA · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Command injection, SQL injection, Code injection
- [WeGIA: Unauthenticated SQL Injection in cadastro_cobranca.php via "codigo" parameter](https://agentprime.io/advisories/CVE-2026-55680.md)
  `CVE-2026-55680` · CVE record: LabRedesCefetRJ WeGIA · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection
- [WeGIA: SQL Injection in html/socio/sistema/cadastro_cobranca.php](https://agentprime.io/advisories/CVE-2026-55683.md)
  `CVE-2026-55683` · CVE record: LabRedesCefetRJ WeGIA · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: SQL injection
- [WeGIA: Hardcoded Secret Key Backdoor — Mass Data Destruction via deletar_socios.php](https://agentprime.io/advisories/CVE-2026-54767.md)
  `CVE-2026-54767` · CVE record: LabRedesCefetRJ WeGIA · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Authentication bypass, Hard-coded credentials
- [WeGIA: Authorization Bypass via Empty Resource Array in InternoControle](https://agentprime.io/advisories/CVE-2026-54671.md)
  `CVE-2026-54671` · CVE record: LabRedesCefetRJ WeGIA · CVSS 8.8 High · Not analysed yet · Published 17 Sept 2026 · Tags: Broken access control
- [WeGIA: Unauthenticated Auth Bypass + Local File Inclusion](https://agentprime.io/advisories/CVE-2026-54670.md)
  `CVE-2026-54670` · CVE record: LabRedesCefetRJ WeGIA · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 17 Sept 2026 · Tags: Path traversal, Authentication bypass
- [WeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.php](https://agentprime.io/advisories/CVE-2026-76634.md)
  `CVE-2026-76634` · CVE record: LabRedesCefetRJ WeGIA · CVSS 7.1 High · Not analysed yet · Published 20 Aug 2026 · Tags: Broken access control
- [WeGIA < 3.9.2 Authorization Bypass Password Change via alterarSenha](https://agentprime.io/advisories/CVE-2026-76633.md)
  `CVE-2026-76633` · CVE record: LabRedesCefetRJ WeGIA · CVSS 8.6 High · Not analysed yet · Published 20 Aug 2026 · Tags: Broken access control, CWE-620
- [WeGIA: Middleware whitelist bypass → open redirect via InternoControle.nextPage](https://agentprime.io/advisories/CVE-2026-45335.md)
  `CVE-2026-45335` · CVE record: LabRedesCefetRJ WeGIA · CVSS 5.4 Medium · Not analysed yet · Published 27 May 2026 · Tags: Open redirect
- [WeGIA: Use of Weak Password Hashing Algorithm (SHA-256, no salt) in html/login.php](https://agentprime.io/advisories/CVE-2026-45027.md)
  `CVE-2026-45027` · CVE record: LabRedesCefetRJ WeGIA · CVSS 5.9 Medium · Not analysed yet · Published 27 May 2026 · Tags: Weak cryptography or TLS, CWE-759
- [WeGIA: Stored XSS in html/atendido/processo_aceitacao.php](https://agentprime.io/advisories/CVE-2026-45026.md)
  `CVE-2026-45026` · CVE record: LabRedesCefetRJ WeGIA · CVSS 6.8 Medium · Not analysed yet · Published 11 May 2026 · Tags: Cross-site scripting (XSS)
- [WeGIA: Stored XSS in html/atendido/etapa_processo.php](https://agentprime.io/advisories/CVE-2026-45025.md)
  `CVE-2026-45025` · CVE record: LabRedesCefetRJ WeGIA · CVSS 6.8 Medium · Not analysed yet · Published 11 May 2026 · Tags: Cross-site scripting (XSS)
- [WeGIA: Error Handling Upload DocDependente](https://agentprime.io/advisories/CVE-2026-42873.md)
  `CVE-2026-42873` · CVE record: LabRedesCefetRJ WeGIA · CVSS 0.0 None · Not analysed yet · Published 11 May 2026 · Tags: Information disclosure
- [WeGIA: Reflected XSS in listar_arquivos_etapa.php](https://agentprime.io/advisories/CVE-2026-42872.md)
  `CVE-2026-42872` · CVE record: LabRedesCefetRJ WeGIA · CVSS 6.1 Medium · Not analysed yet · Published 11 May 2026 · Tags: Cross-site scripting (XSS)
- [WeGIA: Cross-Site Scripting (XSS) Stored endpoint 'informacao_adicional.php' parameter 'descricao'](https://agentprime.io/advisories/CVE-2026-42870.md)
  `CVE-2026-42870` · CVE record: LabRedesCefetRJ WeGIA · CVSS 6.4 Medium · Not analysed yet · Published 11 May 2026 · Tags: Cross-site scripting (XSS)
- [WeGIA: Error Handling familiar_docfamiliar](https://agentprime.io/advisories/CVE-2026-42871.md)
  `CVE-2026-42871` · CVE record: LabRedesCefetRJ WeGIA · CVSS 6.9 Medium · Not analysed yet · Published 11 May 2026 · Tags: Information disclosure
- [WeGIA has Cross-Site Scripting in Controle de Contribuição](https://agentprime.io/advisories/CVE-2026-40286.md)
  `CVE-2026-40286` · CVE record: LabRedesCefetRJ WeGIA · CVSS 7.5 High · Not analysed yet · Published 17 Apr 2026 · Tags: Cross-site scripting (XSS)
- [WeGIA has SQL Injection via Session Variable Override in DespachoControle.php](https://agentprime.io/advisories/CVE-2026-40285.md)
  `CVE-2026-40285` · CVE record: LabRedesCefetRJ WeGIA · CVSS 8.8 High · Not analysed yet · Published 17 Apr 2026 · Tags: SQL injection, CWE-302, CWE-473
- [WeGIA has stored XSS in listar_despachos.php](https://agentprime.io/advisories/CVE-2026-40284.md)
  `CVE-2026-40284` · CVE record: LabRedesCefetRJ WeGIA · CVSS 6.8 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: Cross-site scripting (XSS)
- [WeGIA has stored XSS in intercorrencia_visualizar.php](https://agentprime.io/advisories/CVE-2026-40282.md)
  `CVE-2026-40282` · CVE record: LabRedesCefetRJ WeGIA · CVSS 6.4 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: Cross-site scripting (XSS)
- [WeGIA has stored XSS in profile_paciente.php](https://agentprime.io/advisories/CVE-2026-40283.md)
  `CVE-2026-40283` · CVE record: LabRedesCefetRJ WeGIA · CVSS 6.8 Medium · Not analysed yet · Published 17 Apr 2026 · Tags: Cross-site scripting (XSS)
- [WeGIA - Open Redirect - backup redirection — Unvalidated $\_GET\['redirect'\]](https://agentprime.io/advisories/CVE-2026-35475.md)
  `CVE-2026-35475` · CVE record: LabRedesCefetRJ WeGIA · CVSS 5.1 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Open redirect
- [WeGIA - Open Redirect - atualizacao redirection - Unvalidated $\_GET\['redirect'\]](https://agentprime.io/advisories/CVE-2026-35474.md)
  `CVE-2026-35474` · CVE record: LabRedesCefetRJ WeGIA · CVSS 5.1 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Open redirect
- [WeGIA - Open Redirect - IentradaControle - listarId() - Unvalidated $\_GET\['nextPage'\]](https://agentprime.io/advisories/CVE-2026-35473.md)
  `CVE-2026-35473` · CVE record: LabRedesCefetRJ WeGIA · CVSS 5.1 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Open redirect
- [WeGIA has Stored XSS in backup file names](https://agentprime.io/advisories/CVE-2026-35399.md)
  `CVE-2026-35399` · CVE record: LabRedesCefetRJ WeGIA · CVSS 8.5 High · Not analysed yet · Published 6 Apr 2026 · Tags: Cross-site scripting (XSS)
- [WeGIA - Open Redirect - EstoqueControle - listarTodos() - Unvalidated $\_GET\['nextPage'\]](https://agentprime.io/advisories/CVE-2026-35472.md)
  `CVE-2026-35472` · CVE record: LabRedesCefetRJ WeGIA · CVSS 5.1 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Open redirect
- [WeGIA - Open Redirect - OrigemControle - listarTodos() & listarId_Nome() - Unvalidated $\_GET\['nextPage'\]](https://agentprime.io/advisories/CVE-2026-35398.md)
  `CVE-2026-35398` · CVE record: LabRedesCefetRJ WeGIA · CVSS 5.1 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Open redirect
- [WeGIA - Open Redirect - IsaidaControle - listarId() - Unvalidated $\_GET\['nextPage'\]](https://agentprime.io/advisories/CVE-2026-35396.md)
  `CVE-2026-35396` · CVE record: LabRedesCefetRJ WeGIA · CVSS 5.1 Medium · Not analysed yet · Published 6 Apr 2026 · Tags: Open redirect
- [WeGIA has a SQL Injection in DespachoDAO.php via id_memorando parameter](https://agentprime.io/advisories/CVE-2026-35395.md)
  `CVE-2026-35395` · CVE record: LabRedesCefetRJ WeGIA · CVSS 8.8 High · Not analysed yet · Published 6 Apr 2026 · Tags: SQL injection
- [WeGIA has SQL Injection in deletar_tag.php](https://agentprime.io/advisories/CVE-2026-33991.md)
  `CVE-2026-33991` · CVE record: LabRedesCefetRJ WeGIA · CVSS 8.8 High · Not analysed yet · Published 27 Mar 2026 · Tags: SQL injection
- [WeGIA has Reflected Cross-Site Scripting (XSS) in \`listar_memorandos_ativos.php\` via \`sccd\` parameter](https://agentprime.io/advisories/CVE-2026-33136.md)
  `CVE-2026-33136` · CVE record: LabRedesCefetRJ WeGIA · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Mar 2026 · Tags: Cross-site scripting (XSS)
- [WeGIA has Reflected Cross-Site Scripting (XSS) in \`novo_memorandoo.php\` via \`sccs\` parameter](https://agentprime.io/advisories/CVE-2026-33135.md)
  `CVE-2026-33135` · CVE record: LabRedesCefetRJ WeGIA · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Mar 2026 · Tags: Cross-site scripting (XSS)
- [WeGIA has Authenticated Time-Based Blind SQL Injection in \`restaurar_produto.php\` via \`id_produto\` parameter](https://agentprime.io/advisories/CVE-2026-33134.md)
  `CVE-2026-33134` · CVE record: LabRedesCefetRJ WeGIA · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Mar 2026 · Tags: SQL injection
- [WeGIA has an arbitrary SQL execution vulnerability via crafted backup archive](https://agentprime.io/advisories/CVE-2026-33133.md)
  `CVE-2026-33133` · CVE record: LabRedesCefetRJ WeGIA · CVSS 8.6 High · Not analysed yet · Published 20 Mar 2026 · Tags: SQL injection
- [WeGIA has a Time-Based Blind SQL Injection in remover_produto_ocultar.php](https://agentprime.io/advisories/CVE-2026-31896.md)
  `CVE-2026-31896` · CVE record: LabRedesCefetRJ WeGIA · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 11 Mar 2026 · Tags: SQL injection
- [WeGIA has a SQL Injection via Direct Query Interpolation in restaurar_produto.php](https://agentprime.io/advisories/CVE-2026-31895.md)
  `CVE-2026-31895` · CVE record: LabRedesCefetRJ WeGIA · CVSS 8.8 High · Not analysed yet · Published 11 Mar 2026 · Tags: SQL injection
- [WeGIA affected by arbitrary file read via symlink in backup restore](https://agentprime.io/advisories/CVE-2026-31894.md)
  `CVE-2026-31894` · CVE record: LabRedesCefetRJ WeGIA · CVSS 6.9 Medium · Not analysed yet · Published 11 Mar 2026 · Tags: Path traversal
- [WeGIA Vulnerable to Authentication Bypass via \`extract($\_REQUEST)\`](https://agentprime.io/advisories/CVE-2026-28411.md)
  `CVE-2026-28411` · CVE record: LabRedesCefetRJ WeGIA · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Feb 2026 · Tags: Authentication bypass, CWE-473
- [WeGIA Vulnerable to Remote Code Execution (RCE) via OS Command Injection](https://agentprime.io/advisories/CVE-2026-28409.md)
  `CVE-2026-28409` · CVE record: LabRedesCefetRJ WeGIA · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Feb 2026 · Tags: Command injection
- [WeGIA lacks authentication verification in adicionar_tipo_docs_atendido.php](https://agentprime.io/advisories/CVE-2026-28408.md)
  `CVE-2026-28408` · CVE record: LabRedesCefetRJ WeGIA · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Feb 2026 · Tags: Authentication bypass, Broken access control
- [WeGIA Clickjacking Vulnerability](https://agentprime.io/advisories/CVE-2026-23731.md)
  `CVE-2026-23731` · CVE record: LabRedesCefetRJ WeGIA · CVSS 4.3 Medium · Not analysed yet · Published 16 Jan 2026 · Tags: CWE-1021
- [WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=ProdutoControle)](https://agentprime.io/advisories/CVE-2026-23730.md)
  `CVE-2026-23730` · CVE record: LabRedesCefetRJ WeGIA · CVSS 4.8 Medium · Not analysed yet · Published 16 Jan 2026 · Tags: Open redirect
- [WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarDescricao, nomeClasse=ProdutoControle)](https://agentprime.io/advisories/CVE-2026-23729.md)
  `CVE-2026-23729` · CVE record: LabRedesCefetRJ WeGIA · CVSS 4.8 Medium · Not analysed yet · Published 16 Jan 2026 · Tags: Open redirect
- [WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=DestinoControle)](https://agentprime.io/advisories/CVE-2026-23728.md)
  `CVE-2026-23728` · CVE record: LabRedesCefetRJ WeGIA · CVSS 4.8 Medium · Not analysed yet · Published 16 Jan 2026 · Tags: Open redirect
- [WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=TipoSaidaControle)](https://agentprime.io/advisories/CVE-2026-23727.md)
  `CVE-2026-23727` · CVE record: LabRedesCefetRJ WeGIA · CVSS 4.8 Medium · Not analysed yet · Published 16 Jan 2026 · Tags: Open redirect
- [WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=TipoEntradaControle)](https://agentprime.io/advisories/CVE-2026-23726.md)
  `CVE-2026-23726` · CVE record: LabRedesCefetRJ WeGIA · CVSS 4.8 Medium · Not analysed yet · Published 16 Jan 2026 · Tags: Open redirect
- [WeGIA Stored Cross-Site Scripting (XSS) – nome Parameter on Adopters Information Page](https://agentprime.io/advisories/CVE-2026-23725.md)
  `CVE-2026-23725` · CVE record: LabRedesCefetRJ WeGIA · CVSS 5.3 Medium · Not analysed yet · Published 16 Jan 2026 · Tags: Cross-site scripting (XSS)
- [WeGIA Stored Cross-Site Scripting (XSS) – atendido_idatendido Parameter on Occurrence Registration Page](https://agentprime.io/advisories/CVE-2026-23724.md)
  `CVE-2026-23724` · CVE record: LabRedesCefetRJ WeGIA · CVSS 4.3 Medium · Not analysed yet · Published 16 Jan 2026 · Tags: Cross-site scripting (XSS)
- [WeGIA has a Reflected Cross-Site Scripting (XSS) vulnerability allowing arbitrary code execution and UI redressing.](https://agentprime.io/advisories/CVE-2026-23722.md)
  `CVE-2026-23722` · CVE record: LabRedesCefetRJ WeGIA · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jan 2026 · Tags: Cross-site scripting (XSS)
- [WeGIA has a Critical SQL Injection in Atendido_ocorrenciaControle via id_memorando parameter](https://agentprime.io/advisories/CVE-2026-23723.md)
  `CVE-2026-23723` · CVE record: LabRedesCefetRJ WeGIA · CVSS 7.2 High · Not analysed yet · Published 16 Jan 2026 · Tags: SQL injection
- [WeGIA is vulnerable to SQL Injection via editar_categoria endpoint parameter](https://agentprime.io/advisories/CVE-2025-67501.md)
  `CVE-2025-67501` · CVE record: LabRedesCefetRJ WeGIA · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Dec 2025 · Tags: SQL injection
- [WeGia is Vulnerable to XSS through id_pessoa Parameter on Password Configuration Page](https://agentprime.io/advisories/CVE-2025-67496.md)
  `CVE-2025-67496` · CVE record: LabRedesCefetRJ WeGIA · CVSS 4.3 Medium · Not analysed yet · Published 9 Dec 2025 · Tags: Cross-site scripting (XSS)
- [WeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar_info_pessoal.php' Parameter 'action'](https://agentprime.io/advisories/CVE-2025-62598.md)
  `CVE-2025-62598` · CVE record: LabRedesCefetRJ WeGIA · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2025 · Tags: Cross-site scripting (XSS)
- [WeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar_info_pessoal.php' Parameter 'sql'](https://agentprime.io/advisories/CVE-2025-62597.md)
  `CVE-2025-62597` · CVE record: LabRedesCefetRJ WeGIA · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2025 · Tags: Cross-site scripting (XSS)

Older: <https://agentprime.io/advisories/technology/labredescefetrj-wegia.md?cursor=WyIyMDI1LTEwLTIxVDE2OjM0OjE5Ljc3NTAwMFoiLCJDVkUtMjAyNS02MjU5NyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=labredescefetrj-wegia>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/labredescefetrj-wegia/>. Everything for agents: <https://agentprime.io/llms.txt>.