Advisories · Technology
LabRedesCefetRJ WeGIA.
Every CVE that names LabRedesCefetRJ WeGIA among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.9 High
WeGIA: Stored Cross-Site Scripting (XSS) in "historico_prontuarios.php" via "textoProntuario" Field
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 6.3 Medium
WeGIA: Stored DOM XSS in listar_despachos.php Allows Account Takeover
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 8.1 High
WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes
- LabRedesCefetRJ WeGIA
- Cross-site request forgery (CSRF)
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 8.1 High
WeGIA: Session Fixation via User-Controlled PHPSESSID Cookie + DB_HOST Leak in html/seguranca/sessionStart.php
- LabRedesCefetRJ WeGIA
- Information disclosure
- Authentication bypass
- CVSS 8.8 High
WeGIA: SQL Injection in html/matPat/restaurar_produto_desocultar.php via id_produto parameter
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 6.5 Medium
WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection
- LabRedesCefetRJ WeGIA
- Command injection
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
WeGIA: Unauthenticated SQL Injection in cadastro_cobranca.php via "codigo" parameter
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
WeGIA: SQL Injection in html/socio/sistema/cadastro_cobranca.php
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 9.1 CriticalCritical · CVSS 9+
WeGIA: Hardcoded Secret Key Backdoor — Mass Data Destruction via deletar_socios.php
- LabRedesCefetRJ WeGIA
- Authentication bypass
- Hard-coded credentials
- CVSS 8.8 High
WeGIA: Authorization Bypass via Empty Resource Array in InternoControle
- LabRedesCefetRJ WeGIA
- Broken access control
- CVSS 9.1 CriticalCritical · CVSS 9+
WeGIA: Unauthenticated Auth Bypass + Local File Inclusion
- LabRedesCefetRJ WeGIA
- Path traversal
- Authentication bypass
- CVSS 7.1 High
WeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.php
- LabRedesCefetRJ WeGIA
- Broken access control
- CVSS 8.6 High
WeGIA < 3.9.2 Authorization Bypass Password Change via alterarSenha
- LabRedesCefetRJ WeGIA
- Broken access control
- CWE-620
- CVSS 5.4 Medium
WeGIA: Middleware whitelist bypass → open redirect via InternoControle.nextPage
- LabRedesCefetRJ WeGIA
- Open redirect
- CVSS 5.9 Medium
WeGIA: Use of Weak Password Hashing Algorithm (SHA-256, no salt) in html/login.php
- LabRedesCefetRJ WeGIA
- Weak cryptography or TLS
- CWE-759
- CVSS 6.8 Medium
WeGIA: Stored XSS in html/atendido/processo_aceitacao.php
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
WeGIA: Stored XSS in html/atendido/etapa_processo.php
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 0.0 None
WeGIA: Error Handling Upload DocDependente
- LabRedesCefetRJ WeGIA
- Information disclosure
- CVSS 6.1 Medium
WeGIA: Reflected XSS in listar_arquivos_etapa.php
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WeGIA: Cross-Site Scripting (XSS) Stored endpoint 'informacao_adicional.php' parameter 'descricao'
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
WeGIA: Error Handling familiar_docfamiliar
- LabRedesCefetRJ WeGIA
- Information disclosure
- CVSS 7.5 High
WeGIA has Cross-Site Scripting in Controle de Contribuição
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 8.8 High
WeGIA has SQL Injection via Session Variable Override in DespachoControle.php
- LabRedesCefetRJ WeGIA
- SQL injection
- CWE-302
- CVSS 6.8 Medium
WeGIA has stored XSS in listar_despachos.php
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WeGIA has stored XSS in intercorrencia_visualizar.php
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
WeGIA has stored XSS in profile_paciente.php
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
WeGIA - Open Redirect - backup redirection — Unvalidated $_GET['redirect']
- LabRedesCefetRJ WeGIA
- Open redirect
- CVSS 5.1 Medium
WeGIA - Open Redirect - atualizacao redirection - Unvalidated $_GET['redirect']
- LabRedesCefetRJ WeGIA
- Open redirect
- CVSS 5.1 Medium
WeGIA - Open Redirect - IentradaControle - listarId() - Unvalidated $_GET['nextPage']
- LabRedesCefetRJ WeGIA
- Open redirect
- CVSS 8.5 High
WeGIA has Stored XSS in backup file names
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
WeGIA - Open Redirect - EstoqueControle - listarTodos() - Unvalidated $_GET['nextPage']
- LabRedesCefetRJ WeGIA
- Open redirect
- CVSS 5.1 Medium
WeGIA - Open Redirect - OrigemControle - listarTodos() & listarId_Nome() - Unvalidated $_GET['nextPage']
- LabRedesCefetRJ WeGIA
- Open redirect
- CVSS 5.1 Medium
WeGIA - Open Redirect - IsaidaControle - listarId() - Unvalidated $_GET['nextPage']
- LabRedesCefetRJ WeGIA
- Open redirect
- CVSS 8.8 High
WeGIA has a SQL Injection in DespachoDAO.php via id_memorando parameter
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 8.8 High
WeGIA has SQL Injection in deletar_tag.php
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 9.3 CriticalCritical · CVSS 9+
WeGIA has Reflected Cross-Site Scripting (XSS) in `listar_memorandos_ativos.php` via `sccd` parameter
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
WeGIA has Reflected Cross-Site Scripting (XSS) in `novo_memorandoo.php` via `sccs` parameter
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
WeGIA has Authenticated Time-Based Blind SQL Injection in `restaurar_produto.php` via `id_produto` parameter
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 8.6 High
WeGIA has an arbitrary SQL execution vulnerability via crafted backup archive
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
WeGIA has a Time-Based Blind SQL Injection in remover_produto_ocultar.php
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 8.8 High
WeGIA has a SQL Injection via Direct Query Interpolation in restaurar_produto.php
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 6.9 Medium
WeGIA affected by arbitrary file read via symlink in backup restore
- LabRedesCefetRJ WeGIA
- Path traversal
- CVSS 9.8 CriticalCritical · CVSS 9+
WeGIA Vulnerable to Authentication Bypass via `extract($_REQUEST)`
- LabRedesCefetRJ WeGIA
- Authentication bypass
- CWE-473
- CVSS 10.0 CriticalCritical · CVSS 9+
WeGIA Vulnerable to Remote Code Execution (RCE) via OS Command Injection
- LabRedesCefetRJ WeGIA
- Command injection
- CVSS 9.8 CriticalCritical · CVSS 9+
WeGIA lacks authentication verification in adicionar_tipo_docs_atendido.php
- LabRedesCefetRJ WeGIA
- Authentication bypass
- Broken access control
- CVSS 4.3 Medium
WeGIA Clickjacking Vulnerability
- LabRedesCefetRJ WeGIA
- CWE-1021
- CVSS 4.8 Medium
WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=ProdutoControle)
- LabRedesCefetRJ WeGIA
- Open redirect
- CVSS 4.8 Medium
WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarDescricao, nomeClasse=ProdutoControle)
- LabRedesCefetRJ WeGIA
- Open redirect
- CVSS 4.8 Medium
WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=DestinoControle)
- LabRedesCefetRJ WeGIA
- Open redirect
- CVSS 4.8 Medium
WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=TipoSaidaControle)
- LabRedesCefetRJ WeGIA
- Open redirect
- CVSS 4.8 Medium
WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=TipoEntradaControle)
- LabRedesCefetRJ WeGIA
- Open redirect
- CVSS 5.3 Medium
WeGIA Stored Cross-Site Scripting (XSS) – nome Parameter on Adopters Information Page
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
WeGIA Stored Cross-Site Scripting (XSS) – atendido_idatendido Parameter on Occurrence Registration Page
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 9.1 CriticalCritical · CVSS 9+
WeGIA has a Reflected Cross-Site Scripting (XSS) vulnerability allowing arbitrary code execution and UI redressing.
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 7.2 High
WeGIA has a Critical SQL Injection in Atendido_ocorrenciaControle via id_memorando parameter
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 9.4 CriticalCritical · CVSS 9+
WeGIA is vulnerable to SQL Injection via editar_categoria endpoint parameter
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 4.3 Medium
WeGia is Vulnerable to XSS through id_pessoa Parameter on Password Configuration Page
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
WeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar_info_pessoal.php' Parameter 'action'
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
WeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar_info_pessoal.php' Parameter 'sql'
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)