CVE Explorer

CVE-2026-28408

WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, the script in adicionar_tipo_docs_atendido.php does not go through the project's central controller and does not have its own authentication and permission checks. A malicious user could make a request through tools like Postman or the file's URL on the web to access features exclusive to employees. The vulnerability allows external parties to inject unauthorized data in massive quantities into the application server's s

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:1054558d6ba6547dc579479c80e95c4cba3b76e187e374cfc9139ed6bfb100d8

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

cwe · 2 assertions

{"cweId":"CWE-287","description":"CWE-287: Improper Authentication","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:ff0ed472becc2c031b45394886c7a3d6d59e0852eabe4f9a0f5652006dd6ae28 · sha256:29b48f7e1e90c663… · /containers/cna/problemTypes/1/descriptions/0

{"cweId":"CWE-862","description":"CWE-862: Missing Authorization","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:ff0ed472becc2c031b45394886c7a3d6d59e0852eabe4f9a0f5652006dd6ae28 · sha256:29b48f7e1e90c663… · /containers/cna/problemTypes/0/descriptions/0

Affected products and versions

1 source assertion

{"product":"WeGIA","vendor":"LabRedesCefetRJ","versions":[{"status":"affected","version":"< 3.6.5"}]}

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:ff0ed472becc2c031b45394886c7a3d6d59e0852eabe4f9a0f5652006dd6ae28 · sha256:29b48f7e1e90c663… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion

{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:ff0ed472becc2c031b45394886c7a3d6d59e0852eabe4f9a0f5652006dd6ae28 · sha256:29b48f7e1e90c663… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

2 source assertions

{"cweId":"CWE-287","description":"CWE-287: Improper Authentication","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:ff0ed472becc2c031b45394886c7a3d6d59e0852eabe4f9a0f5652006dd6ae28 · sha256:29b48f7e1e90c663… · /containers/cna/problemTypes/1/descriptions/0

{"cweId":"CWE-862","description":"CWE-862: Missing Authorization","lang":"en","type":"CWE"}

cve_program_cvelist_v5cwe
urn:baitaphish:normalized-source-record:v2:ff0ed472becc2c031b45394886c7a3d6d59e0852eabe4f9a0f5652006dd6ae28 · sha256:29b48f7e1e90c663… · /containers/cna/problemTypes/0/descriptions/0

Source references

1 source assertion

{"name":"https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-xq3w-xwxj-fg2q","tags":["x_refsource_CONFIRM"],"url":"https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-xq3w-xwxj-fg2q"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:ff0ed472becc2c031b45394886c7a3d6d59e0852eabe4f9a0f5652006dd6ae28 · sha256:29b48f7e1e90c663… · /containers/cna/references/0

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer