CVE-2026-28408: falha crítica em LabRedesCefetRJ WeGIA
WeGIA lacks authentication verification in adicionar_tipo_docs_atendido.php
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 0.6%
WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, the script in adicionar_tipo_docs_atendido.php does not go through the project's central controller and does not have its own authentication and permission checks. A malicious user could make a request through tools like Postman or the file's URL on the web to access features exclusive to employees. The vulnerability allows external parties to inject unauthorized data in massive quantities into the application server's storage. Version 3.6.5 fixes the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
LabRedesCefetRJ · WeGIACVEs relacionadas — LabRedesCefetRJ WeGIA
No mesmo produto, das mais perigosas para as menos.
CVE-2025-50201CRITICALWeGIA OS Command Injection in debug_info.php parameter 'branch'EPSS 4.7%CVE-2026-28409CRITICALWeGIA Vulnerable to Remote Code Execution (RCE) via OS Command InjectionEPSS 3.6%CVE-2025-27140CRITICALWeGIA vulnerable to OS Command Injection at endpoint 'importar_dump.php' parameter 'import' (RCE)EPSS 2.9%CVE-2026-28411CRITICALWeGIA Vulnerable to Authentication Bypass via `extract($_REQUEST)`EPSS 2.7%CVE-2025-26613CRITICALOS Command Injection endpoint 'gerenciar_backup.php' parameter 'file' (RCE) in WeGIAEPSS 2.5%CVE-2025-55169CRITICALWeGIA Path Traversal at endpoint 'html/socio/sistema/download_remessa.php' via parameter 'file'EPSS 1.7%