CVE-2026-42873noneCWE-200

CVE-2026-42873: vulnerability in LabRedesCefetRJ WeGIA

WeGIA: Error Handling Upload DocDependente

Published · Updated

Follow this CVE+ Monitor WeGIA

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 0epss 0.2%
WeGIA is a web manager for charitable institutions. In versions prior to 3.6.10, when attempting to upload a file with malicious content to funcionario/docdependente_upload.php, the application responds with an overly descriptive error message. This leads to information disclosure, effectively increasing the attack surface by providing potential attackers with technical insights to refine their exploits. This vulnerability is fixed in 3.6.10.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N
Affected products
LabRedesCefetRJ · WeGIA
Related CVEs — LabRedesCefetRJ WeGIA

In the same product, most dangerous first.

CVE-2025-50201CRITICALWeGIA OS Command Injection in debug_info.php parameter 'branch'EPSS 4.7%CVE-2026-28409CRITICALWeGIA Vulnerable to Remote Code Execution (RCE) via OS Command InjectionEPSS 3.6%CVE-2025-27140CRITICALWeGIA vulnerable to OS Command Injection at endpoint 'importar_dump.php' parameter 'import' (RCE)EPSS 2.9%CVE-2026-28411CRITICALWeGIA Vulnerable to Authentication Bypass via `extract($_REQUEST)`EPSS 2.7%CVE-2025-26613CRITICALOS Command Injection endpoint 'gerenciar_backup.php' parameter 'file' (RCE) in WeGIAEPSS 2.5%CVE-2025-55169CRITICALWeGIA Path Traversal at endpoint 'html/socio/sistema/download_remessa.php' via parameter 'file'EPSS 1.7%