CVE-2026-42872: medium-severity vulnerability in LabRedesCefetRJ WeGIA
WeGIA: Reflected XSS in listar_arquivos_etapa.php
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.1epss 0.2%
WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a reflected Cross-Site Scripting (XSS) vulnerability exists in lista_arquivos_etapa.php due to improper handling of user-supplied input. The id_processo parameter is directly embedded into the HTML without sanitization, allowing attackers to inject arbitrary JavaScript. This can lead to session hijacking, credential theft, or execution of malicious actions in the context of the victim's browser. This vulnerability is fixed in 3.7.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
LabRedesCefetRJ · WeGIARelated CVEs — LabRedesCefetRJ WeGIA
In the same product, most dangerous first.
CVE-2025-50201CRITICALWeGIA OS Command Injection in debug_info.php parameter 'branch'EPSS 4.7%CVE-2026-28409CRITICALWeGIA Vulnerable to Remote Code Execution (RCE) via OS Command InjectionEPSS 3.6%CVE-2025-27140CRITICALWeGIA vulnerable to OS Command Injection at endpoint 'importar_dump.php' parameter 'import' (RCE)EPSS 2.9%CVE-2026-28411CRITICALWeGIA Vulnerable to Authentication Bypass via `extract($_REQUEST)`EPSS 2.7%CVE-2025-26613CRITICALOS Command Injection endpoint 'gerenciar_backup.php' parameter 'file' (RCE) in WeGIAEPSS 2.5%CVE-2025-55169CRITICALWeGIA Path Traversal at endpoint 'html/socio/sistema/download_remessa.php' via parameter 'file'EPSS 1.7%