Advisories · Technology
LabRedesCefetRJ WeGIA.
Every CVE that names LabRedesCefetRJ WeGIA among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 4.8 Medium
WeGIA Open Redirect Vulnerability in `control.php` endpoint `nextPage` parameter (metodo=listarTodos nomeClasse=AlmoxarifeControle)
- LabRedesCefetRJ WeGIA
- Open redirect
- CVSS 9.4 CriticalCritical · CVSS 9+
WeGIA SQL Injection via 'id_dependente' param at endpoint `/html/funcionario/dependente_documento.php`
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 5.3 Medium
WeGIA Cross-Site Scripting (XSS) Reflected endpoint id_pet
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
WeGIA Reflected XSS to Account TakeOver at /html/configuracao/configuracao_geral.php via log parameter
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 8.6 High
WeGIA SQL Injection via 'cpf' param at endpoint `/html/funcionario/cadastro_funcionario_pessoa_existente.php`
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 3.5 Low
WeGIA Cross-Site Scripting (XSS) Reflected endpoint '/html/atendido/cadastro_atendido_parentesco_pessoa_nova.php' parameter 'idatendido'
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 8.6 High
WeGIA vulnerable to SQL Injection via 'id_funcionario' param at endpoint `/html/funcionario/dependente_listar.php`
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 8.7 High
WeGIA: Broken Access Control in `get_relatorios_socios.php` Endpoint
- LabRedesCefetRJ WeGIA
- Information disclosure
- Authentication bypass
- CVSS 4.8 Medium
WeGIA: Open Redirect Vulnerability in `control.php` endpoint
- LabRedesCefetRJ WeGIA
- Open redirect
- CVSS 9.4 CriticalCritical · CVSS 9+
WeGIA: SQL Injection (Blind Time-Based) Vulnerability in /pet/profile_pet.php Endpoint
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 7.1 High
WeGIA: Cross-Site Request Forgery (CSRF) Vulnerability in `control.php` Endpoint
- LabRedesCefetRJ WeGIA
- Cross-site request forgery (CSRF)
- CVSS 9.4 CriticalCritical · CVSS 9+
WeGIA: SQL Injection (Blind Time-Based) Vulnerability in API `descricao` Parameter
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 8.8 High
WeGIA vulnerable to SQL Injection into method `excluir` of the `ProdutoControle` class in the parameter `id_produto`.
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 10.0 CriticalCritical · CVSS 9+
WeGIA has a bypass for the fix for CVE-2025-22133 - Arbitrary File Upload leads to Remote Code Execution (RCE)
- LabRedesCefetRJ WeGIA
- Code injection
- Unrestricted file upload
- CVSS 8.9 High
WeGIA vulnerable to Blind Time-Based SQL Injection in endpoint 'listar_despachos.php' parameter 'id_memorando'
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 8.9 High
WeGIA vulnerable to Blind Time-Based SQL Injection in endpoint 'exibe_anexo.php' parameter 'id_anexo'
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 2.1 Low
WeGIA vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint 'listar_despachos.php' parameter 'id_memorando'
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 10.0 CriticalCritical · CVSS 9+
WeGIA Authenticated Arbitrary File Upload Leading To Remote Code Execution (RCE)
- LabRedesCefetRJ WeGIA
- Code injection
- Unrestricted file upload
- CVSS 6.5 Medium
WeGIA Cross-Site Scripting (XSS) Reflected endpoint 'pre_cadastro_adotante.php' parameter 'msg_e'
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WeGIA Cross-Site Scripting (XSS) Reflected endpoint 'cargos.php' parameter 'msg_e'
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Cross-Site Scripting (XSS) Reflected in 'insere_despacho.php' parameter 'sccs'
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WeGIA Stored Cross-Site Scripting (XSS) vulnerability in the endpoint 'dependente_docdependente.php' with parameter 'nome'
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 9.4 CriticalCritical · CVSS 9+
WeGIA SQL Injection vulnerability via 'id_funcionario' param at endpoint `/html/funcionario/dependente_remover.php`
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 7.5 High
WeGIA Anonymous Attacker can Delete Arbitrary Image file at endpoint `/html/personalizacao_remover.php`
- LabRedesCefetRJ WeGIA
- Authentication bypass
- CVSS 6.5 Medium
WeGIA reflected XSS via `verificacao` and `redir_config` param at endpoint `/html/alterar_senha.php`
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 10.0 CriticalCritical · CVSS 9+
WeGIA Path Traversal at endpoint 'html/socio/sistema/download_remessa.php' via parameter 'file'
- LabRedesCefetRJ WeGIA
- Path traversal
- Authentication bypass
- CVSS 9.4 CriticalCritical · CVSS 9+
WeGIA SQL Injection via id_fichamedica at endpoint `GET /html/saude/aplicar_medicamento.php`
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 9.4 CriticalCritical · CVSS 9+
WeGIA SQL Injection via id_fichamedica at endpoint `GET/html/funcionario/dependente_remover.php`
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 9.4 CriticalCritical · CVSS 9+
WeGIA vulnerable to SQL Injection (Blind Time-Based) in endpoint 'Profile_Atendido.php' parameter 'idatendido'
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 6.5 Medium
WeGIA Reflected Cross-Site Scripting (XSS) vulnerability in endpoint 'personalizacao_imagem.php' parameter 'err'
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WeGIA Reflected Cross-Site Scripting (XSS) vulnerability in endpoint 'personalizacao.php' parameter 'err'
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WeGIA Reflected Cross-Site Scripting (XSS) vulnerability in endpoint 'pre_cadastro_atendido.php' parameter 'msg_e'
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 9.4 CriticalCritical · CVSS 9+
WeGIA SQL Injection (Blind Time-Based) Vulnerability in id_dependente Parameter on profile_dependente.php Endpoint
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 9.4 CriticalCritical · CVSS 9+
WeGIASQL Injection (Blind Time-Based) Vulnerability in idatendido_familiares Parameter on dependente_editarDoc.php Endpoint
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 9.4 CriticalCritical · CVSS 9+
WeGIA SQL Injection (Blind Time-Based) Vulnerability in idatendido_familiares Parameter on dependente_editarInfoPessoal.php Endpoint
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 9.4 CriticalCritical · CVSS 9+
WeGIA SQL Injection (Blind Time-Based) Vulnerability in idatendido_familiares Parameter on dependente_editarEndereco.php Endpoint
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 9.4 CriticalCritical · CVSS 9+
WeGIA vulnerable to SQL Injection in endpoint profile_paciente.php parameter id_fichamedica
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 6.9 Medium
WeGIA vulnerable to Authentication Bypass due to Missing Session Validation in multiple endpoints
- LabRedesCefetRJ WeGIA
- Authentication bypass
- CVSS 9.4 CriticalCritical · CVSS 9+
WeGIA has SQL Injection (Blind Time-Based) Vulnerability in `cargo` Parameter on `control.php` Endpoint
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 6.4 Medium
WeGIA vulnerable to Reflected Cross-Site Scripting via endpoint `personalizacao_selecao.php` parameter `nome_car`
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WeGIA vulnerable to Reflected Cross-Site Scripting via endpoint `personalizacao_selecao.php` parameter `id`
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WeGIA vulnerable to Stored Cross-Site Scripting via endpoint 'control.php' parameter 'descricao_emergencia'
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WeGIA vulnerable to Stored Cross-Site Scripting via endpoint 'adicionar_enfermidade.php' parameter 'nome'
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WeGIA vulnerable to Reflected Cross-Site Scripting via endpoint 'cadastro_adotante.php' parameter 'cpf'
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WeGIA vulnerable to Stored Cross-Site Scripting via endpoint `adicionar_raca.php` parameter `raca`
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WeGIA vulnerable to Stored Cross-Site Scripting (XSS) via endpoint 'adicionar_especie.php' parameter 'especie'
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WeGIA vulnerable to Stored Cross-Site Scripting (XSS) via endpoint `adicionar_cor.php` parameter `cor`
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WeGIA ReflectedCross-Site Scripting (XSS) vulnerability in endpoint 'cadastro_pet.php' parameter 'msg'
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 10.0 CriticalCritical · CVSS 9+
WeGIA vulnerable to SQL Injection (Blind Time-Based) in `processa_deletar_socio.php` parameter `id_socio`
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 6.5 Medium
WeGIA vulnerable to Reflected Cross-Site Scripting in endpoint 'relatorio_geracao.php' parameter 'tipo_relatorio'
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 4.7 Medium
WeGIA vulnerable to Open Redirect in endpoint 'control.php' parameter 'nextPage'
- LabRedesCefetRJ WeGIA
- Open redirect
- CVSS 6.5 Medium
WeGIA vulnerable to Cross-Site Scripting (XSS) Reflected via endpoint 'index.php' parameter 'erro'
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 8.7 High
WeGIA allows Uncontrolled Resource Consumption via the fid parameter
- LabRedesCefetRJ WeGIA
- Denial of service
- CVSS 8.7 High
WeGIA allows Uncontrolled Resource Consumption via the errorstr parameter
- LabRedesCefetRJ WeGIA
- Denial of service
- CVSS 9.8 CriticalCritical · CVSS 9+
WeGIA allows SQL Injection in html/funcionario/profile_funcionario.php (id_funcionario parameter)
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 8.3 High
WeGIA allows Time-Based Blind SQL Injection in the relatorio_geracao.php endpoint
- LabRedesCefetRJ WeGIA
- SQL injection
- CVSS 2.0 Low
WeGIA allows Stored XSS attacks in novo_memorando.php
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 2.0 Low
WebGia allows Cross-Site Scripting (XSS) in profile_familiar.php via the id_dependente parameter
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 2.0 Low
WebGia allows Cross-Site Scripting (XSS) in cadastro_dependente_pessoa_nova.php via the id_funcionario parameter
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 10.0 CriticalCritical · CVSS 9+
WeGIA has Unauthenticated Time-Based Blind SQL Injection in almox Parameter
- LabRedesCefetRJ WeGIA
- SQL injection