SB20261109171 - Multiple vulnerabilities in WeGIA

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109171

SB20261109171 - Multiple vulnerabilities in WeGIA

Published: November 9, 2026

Security Bulletin ID SB20261109171
CSH Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact

Breakdown by Severity

High 40% Medium 40% Low 20%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows an authenticated attacker to execute arbitrary JavaScript in another user's authenticated WeGIA session.

The vulnerability exists due to missing output encoding of stored memorandum attachment filenames when WeGIA renders attachment links. An authenticated attacker with permission to create and dispatch memorandums can submit a crafted filename that executes JavaScript when the recipient opens the memorandum thread and hovers over the attachment link.


2) Missing Authentication for Critical Function (CVE-ID: N/A)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to create arbitrary remittance records in WeGIA, compromising the integrity of banking and contribution data.

The vulnerability exists due to missing authentication in /WeGIA/html/socio/sistema/cadastro_remessas_geracao.php when processing requests to create remittances. An unauthenticated remote attacker can submit a POST request without a session cookie to persist attacker-controlled remittance data, as demonstrated with zero-value records containing no slips or associated member.


3) Missing Authentication for Critical Function (CVE-ID: N/A)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to bypass authentication for WeGIA's dependent-document upload handler.

The vulnerability exists due to continued request processing in /WeGIA/html/atendido/docfamiliar_upload.php after unauthenticated users are redirected to the login page. An unauthenticated remote attacker can submit multipart uploads that reach file validation without a session and use valid dependent and document-type identifiers to attempt to attach documents to another person's record.


4) Missing Authentication for Critical Function (CVE-ID: N/A)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to change medication statuses in WeGIA and corrupt healthcare workflow data.

The vulnerability exists due to continued execution after a login redirect in /WeGIA/html/saude/status_update.php when a request has no authenticated session. An unauthenticated remote attacker can submit a POST request with a known or guessed medication identifier and a chosen status to reach the database update without user interaction.


5) Exposure of Backup File to an Unauthorized Control Sphere (CVE-ID: N/A)

CWE-ID: CWE-530 - Exposure of Backup File to an Unauthorized Control Sphere

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to obtain server-side PHP source code and database configuration information from WeGIA.

The vulnerability exists due to a backup file stored beneath WeGIA's public web root that Apache serves as data rather than executing as PHP when requested. An unauthenticated remote attacker can request /WeGIA/dao/acesso.php.old to retrieve the source, including a privileged database username and an empty password value.


Remediation

Install update from vendor's website.

References