# cve.now: Labredescefetrj

The newest entries naming Labredescefetrj as an affected vendor (up to 200), of 190 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-61719](https://cve.now/CVE-2026-61719.md): WeGIA: Stored Cross-Site Scripting (XSS) in "historico\_prontuarios.php" via "textoProntuario" Field (CVSS 8.9)
- [CVE-2026-61673](https://cve.now/CVE-2026-61673.md): WeGIA: Stored DOM XSS in listar\_despachos.php Allows Account Takeover (CVSS 6.3)
- [CVE-2026-61671](https://cve.now/CVE-2026-61671.md): WeGIA: Systemic IDOR + Missing CSRF — extract($\_REQUEST) in All Controle Classes (CVSS 8.1)
- [CVE-2026-55684](https://cve.now/CVE-2026-55684.md): WeGIA: SQL Injection in html/socio/sistema/cadastro\_cobrancas\_geracao.php (CVSS 9.8)
- [CVE-2026-55682](https://cve.now/CVE-2026-55682.md): WeGIA: Session Fixation via User-Controlled PHPSESSID Cookie + DB\_HOST Leak in html/seguranca/sessionStart.php (CVSS 8.1)
- [CVE-2026-55681](https://cve.now/CVE-2026-55681.md): WeGIA: SQL Injection in html/matPat/restaurar\_produto\_desocultar.php via id\_produto parameter (CVSS 8.8)
- [CVE-2026-55679](https://cve.now/CVE-2026-55679.md): WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection (CVSS 6.5)
- [CVE-2026-55680](https://cve.now/CVE-2026-55680.md): WeGIA: Unauthenticated SQL Injection in cadastro\_cobranca.php via "codigo" parameter (CVSS 9.8)
- [CVE-2026-55683](https://cve.now/CVE-2026-55683.md): WeGIA: SQL Injection in html/socio/sistema/cadastro\_cobranca.php (CVSS 9.8)
- [CVE-2026-54767](https://cve.now/CVE-2026-54767.md): WeGIA: Hardcoded Secret Key Backdoor — Mass Data Destruction via deletar\_socios.php (CVSS 9.1)
- [CVE-2026-54671](https://cve.now/CVE-2026-54671.md): WeGIA: Authorization Bypass via Empty Resource Array in InternoControle (CVSS 8.8)
- [CVE-2026-54670](https://cve.now/CVE-2026-54670.md): WeGIA: Unauthenticated Auth Bypass + Local File Inclusion (CVSS 9.1)
- [CVE-2026-76634](https://cve.now/CVE-2026-76634.md): WeGIA \< 3.9.2 Insecure Direct Object Reference via profile\_funcionario.php (CVSS 7.1)
- [CVE-2026-76633](https://cve.now/CVE-2026-76633.md): WeGIA \< 3.9.2 Authorization Bypass Password Change via alterarSenha (CVSS 8.6)
- [CVE-2026-45335](https://cve.now/CVE-2026-45335.md): WeGIA: Middleware whitelist bypass → open redirect via InternoControle.nextPage (CVSS 5.4)
- [CVE-2026-45027](https://cve.now/CVE-2026-45027.md): WeGIA: Use of Weak Password Hashing Algorithm (SHA-256, no salt) in html/login.php (CVSS 5.9)
- [CVE-2026-45026](https://cve.now/CVE-2026-45026.md): WeGIA: Stored XSS in html/atendido/processo\_aceitacao.php (CVSS 6.8)
- [CVE-2026-45025](https://cve.now/CVE-2026-45025.md): WeGIA: Stored XSS in html/atendido/etapa\_processo.php (CVSS 6.8)
- [CVE-2026-42873](https://cve.now/CVE-2026-42873.md): WeGIA: Error Handling Upload DocDependente (CVSS 0.0)
- [CVE-2026-42872](https://cve.now/CVE-2026-42872.md): WeGIA: Reflected XSS in listar\_arquivos\_etapa.php (CVSS 6.1)
- [CVE-2026-42870](https://cve.now/CVE-2026-42870.md): WeGIA: Cross-Site Scripting (XSS) Stored endpoint 'informacao\_adicional.php' parameter 'descricao' (CVSS 6.4)
- [CVE-2026-42871](https://cve.now/CVE-2026-42871.md): WeGIA: Error Handling familiar\_docfamiliar (CVSS 6.9)
- [CVE-2026-40286](https://cve.now/CVE-2026-40286.md): WeGIA has Cross-Site Scripting in Controle de Contribuição (CVSS 7.5)
- [CVE-2026-40285](https://cve.now/CVE-2026-40285.md): WeGIA has SQL Injection via Session Variable Override in DespachoControle.php (CVSS 8.8)
- [CVE-2026-40284](https://cve.now/CVE-2026-40284.md): WeGIA has stored XSS in listar\_despachos.php (CVSS 6.8)
- [CVE-2026-40282](https://cve.now/CVE-2026-40282.md): WeGIA has stored XSS in intercorrencia\_visualizar.php (CVSS 6.4)
- [CVE-2026-40283](https://cve.now/CVE-2026-40283.md): WeGIA has stored XSS in profile\_paciente.php (CVSS 6.8)
- [CVE-2026-35475](https://cve.now/CVE-2026-35475.md): WeGIA - Open Redirect - backup redirection — Unvalidated $\_GET\['redirect'\] (CVSS 5.1)
- [CVE-2026-35474](https://cve.now/CVE-2026-35474.md): WeGIA - Open Redirect - atualizacao redirection - Unvalidated $\_GET\['redirect'\] (CVSS 5.1)
- [CVE-2026-35473](https://cve.now/CVE-2026-35473.md): WeGIA - Open Redirect - IentradaControle - listarId() - Unvalidated $\_GET\['nextPage'\] (CVSS 5.1)
- [CVE-2026-35399](https://cve.now/CVE-2026-35399.md): WeGIA has Stored XSS in backup file names (CVSS 8.5)
- [CVE-2026-35472](https://cve.now/CVE-2026-35472.md): WeGIA - Open Redirect - EstoqueControle - listarTodos() - Unvalidated $\_GET\['nextPage'\] (CVSS 5.1)
- [CVE-2026-35398](https://cve.now/CVE-2026-35398.md): WeGIA - Open Redirect - OrigemControle - listarTodos() & listarId\_Nome() - Unvalidated $\_GET\['nextPage'\] (CVSS 5.1)
- [CVE-2026-35396](https://cve.now/CVE-2026-35396.md): WeGIA - Open Redirect - IsaidaControle - listarId() - Unvalidated $\_GET\['nextPage'\] (CVSS 5.1)
- [CVE-2026-35395](https://cve.now/CVE-2026-35395.md): WeGIA has a SQL Injection in DespachoDAO.php via id\_memorando parameter (CVSS 8.8)
- [CVE-2026-33991](https://cve.now/CVE-2026-33991.md): WeGIA has SQL Injection in deletar\_tag.php (CVSS 8.8)
- [CVE-2026-33136](https://cve.now/CVE-2026-33136.md): WeGIA has Reflected Cross-Site Scripting (XSS) in \`listar\_memorandos\_ativos.php\` via \`sccd\` parameter (CVSS 9.3)
- [CVE-2026-33135](https://cve.now/CVE-2026-33135.md): WeGIA has Reflected Cross-Site Scripting (XSS) in \`novo\_memorandoo.php\` via \`sccs\` parameter (CVSS 9.3)
- [CVE-2026-33134](https://cve.now/CVE-2026-33134.md): WeGIA has Authenticated Time-Based Blind SQL Injection in \`restaurar\_produto.php\` via \`id\_produto\` parameter (CVSS 9.3)
- [CVE-2026-33133](https://cve.now/CVE-2026-33133.md): WeGIA has an arbitrary SQL execution vulnerability via crafted backup archive (CVSS 8.6)
- [CVE-2026-31896](https://cve.now/CVE-2026-31896.md): WeGIA has a Time-Based Blind SQL Injection in remover\_produto\_ocultar.php (CVSS 9.8)
- [CVE-2026-31895](https://cve.now/CVE-2026-31895.md): WeGIA has a SQL Injection via Direct Query Interpolation in restaurar\_produto.php (CVSS 8.8)
- [CVE-2026-31894](https://cve.now/CVE-2026-31894.md): WeGIA affected by arbitrary file read via symlink in backup restore (CVSS 6.9)
- [CVE-2026-28411](https://cve.now/CVE-2026-28411.md): WeGIA Vulnerable to Authentication Bypass via \`extract($\_REQUEST)\` (CVSS 9.8)
- [CVE-2026-28409](https://cve.now/CVE-2026-28409.md): WeGIA Vulnerable to Remote Code Execution (RCE) via OS Command Injection (CVSS 10.0)
- [CVE-2026-28408](https://cve.now/CVE-2026-28408.md): WeGIA lacks authentication verification in adicionar\_tipo\_docs\_atendido.php (CVSS 9.8)
- [CVE-2026-23731](https://cve.now/CVE-2026-23731.md): WeGIA Clickjacking Vulnerability (CVSS 4.3)
- [CVE-2026-23730](https://cve.now/CVE-2026-23730.md): WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=ProdutoControle) (CVSS 4.8)
- [CVE-2026-23729](https://cve.now/CVE-2026-23729.md): WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarDescricao, nomeClasse=ProdutoControle) (CVSS 4.8)
- [CVE-2026-23728](https://cve.now/CVE-2026-23728.md): WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=DestinoControle) (CVSS 4.8)
- [CVE-2026-23727](https://cve.now/CVE-2026-23727.md): WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=TipoSaidaControle) (CVSS 4.8)
- [CVE-2026-23726](https://cve.now/CVE-2026-23726.md): WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=TipoEntradaControle) (CVSS 4.8)
- [CVE-2026-23725](https://cve.now/CVE-2026-23725.md): WeGIA Stored Cross-Site Scripting (XSS) – nome Parameter on Adopters Information Page (CVSS 5.3)
- [CVE-2026-23724](https://cve.now/CVE-2026-23724.md): WeGIA Stored Cross-Site Scripting (XSS) – atendido\_idatendido Parameter on Occurrence Registration Page (CVSS 4.3)
- [CVE-2026-23722](https://cve.now/CVE-2026-23722.md): WeGIA has a Reflected Cross-Site Scripting (XSS) vulnerability allowing arbitrary code execution and UI redressing. (CVSS 9.1)
- [CVE-2026-23723](https://cve.now/CVE-2026-23723.md): WeGIA has a Critical SQL Injection in Atendido\_ocorrenciaControle via id\_memorando parameter (CVSS 7.2)
- [CVE-2025-67501](https://cve.now/CVE-2025-67501.md): WeGIA is vulnerable to SQL Injection via editar\_categoria endpoint parameter (CVSS 9.4)
- [CVE-2025-67496](https://cve.now/CVE-2025-67496.md): WeGia is Vulnerable to XSS through id\_pessoa Parameter on Password Configuration Page (CVSS 4.3)
- [CVE-2025-62598](https://cve.now/CVE-2025-62598.md): WeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar\_info\_pessoal.php' Parameter 'action' (CVSS 6.9)
- [CVE-2025-62597](https://cve.now/CVE-2025-62597.md): WeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar\_info\_pessoal.php' Parameter 'sql' (CVSS 6.9)
- [CVE-2025-62361](https://cve.now/CVE-2025-62361.md): WeGIA Open Redirect Vulnerability in \`control.php\` endpoint \`nextPage\` parameter (metodo=listarTodos nomeClasse=AlmoxarifeControle) (CVSS 4.8)
- [CVE-2025-62360](https://cve.now/CVE-2025-62360.md): WeGIA SQL Injection via 'id\_dependente' param at endpoint \`/html/funcionario/dependente\_documento.php\` (CVSS 9.4)
- [CVE-2025-62359](https://cve.now/CVE-2025-62359.md): WeGIA Cross-Site Scripting (XSS) Reflected endpoint id\_pet (CVSS 5.3)
- [CVE-2025-62358](https://cve.now/CVE-2025-62358.md): WeGIA Reflected XSS to Account TakeOver at /html/configuracao/configuracao\_geral.php via log parameter (CVSS 5.4)
- [CVE-2025-62179](https://cve.now/CVE-2025-62179.md): WeGIA SQL Injection via 'cpf' param at endpoint \`/html/funcionario/cadastro\_funcionario\_pessoa\_existente.php\` (CVSS 8.6)
- [CVE-2025-62178](https://cve.now/CVE-2025-62178.md): WeGIA Cross-Site Scripting (XSS) Reflected endpoint '/html/atendido/cadastro\_atendido\_parentesco\_pessoa\_nova.php' parameter 'idatendido' (CVSS 3.5)
- [CVE-2025-62177](https://cve.now/CVE-2025-62177.md): WeGIA vulnerable to SQL Injection via 'id\_funcionario' param at endpoint \`/html/funcionario/dependente\_listar.php\` (CVSS 8.6)
- [CVE-2025-61665](https://cve.now/CVE-2025-61665.md): WeGIA: Broken Access Control in \`get\_relatorios\_socios.php\` Endpoint (CVSS 8.7)
- [CVE-2025-61606](https://cve.now/CVE-2025-61606.md): WeGIA: Open Redirect Vulnerability in \`control.php\` endpoint (CVSS 4.8)
- [CVE-2025-61605](https://cve.now/CVE-2025-61605.md): WeGIA: SQL Injection (Blind Time-Based) Vulnerability in /pet/profile\_pet.php Endpoint (CVSS 9.4)
- [CVE-2025-61604](https://cve.now/CVE-2025-61604.md): WeGIA: Cross-Site Request Forgery (CSRF) Vulnerability in \`control.php\` Endpoint (CVSS 7.1)
- [CVE-2025-61603](https://cve.now/CVE-2025-61603.md): WeGIA: SQL Injection (Blind Time-Based) Vulnerability in API \`descricao\` Parameter (CVSS 9.4)
- [CVE-2025-59939](https://cve.now/CVE-2025-59939.md): WeGIA vulnerable to SQL Injection into method \`excluir\` of the \`ProdutoControle\` class in the parameter \`id\_produto\`. (CVSS 8.8)
- [CVE-2025-58745](https://cve.now/CVE-2025-58745.md): WeGIA has a bypass for the fix for CVE-2025-22133 - Arbitrary File Upload leads to Remote Code Execution (RCE) (CVSS 10.0)
- [CVE-2025-58454](https://cve.now/CVE-2025-58454.md): WeGIA vulnerable to Blind Time-Based SQL Injection in endpoint 'listar\_despachos.php' parameter 'id\_memorando' (CVSS 8.9)
- [CVE-2025-58453](https://cve.now/CVE-2025-58453.md): WeGIA vulnerable to Blind Time-Based SQL Injection in endpoint 'exibe\_anexo.php' parameter 'id\_anexo' (CVSS 8.9)
- [CVE-2025-58452](https://cve.now/CVE-2025-58452.md): WeGIA vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint 'listar\_despachos.php' parameter 'id\_memorando' (CVSS 2.1)
- [CVE-2025-58159](https://cve.now/CVE-2025-58159.md): WeGIA Authenticated Arbitrary File Upload Leading To Remote Code Execution (RCE) (CVSS 10.0)
- [CVE-2025-57765](https://cve.now/CVE-2025-57765.md): WeGIA Cross-Site Scripting (XSS) Reflected endpoint 'pre\_cadastro\_adotante.php' parameter 'msg\_e' (CVSS 6.5)
- [CVE-2025-57764](https://cve.now/CVE-2025-57764.md): WeGIA Cross-Site Scripting (XSS) Reflected endpoint 'cargos.php' parameter 'msg\_e' (CVSS 6.5)
- [CVE-2025-57763](https://cve.now/CVE-2025-57763.md): Cross-Site Scripting (XSS) Reflected in 'insere\_despacho.php' parameter 'sccs' (CVSS 6.4)
- [CVE-2025-57762](https://cve.now/CVE-2025-57762.md): WeGIA Stored Cross-Site Scripting (XSS) vulnerability in the endpoint 'dependente\_docdependente.php' with parameter 'nome' (CVSS 6.4)
- [CVE-2025-57761](https://cve.now/CVE-2025-57761.md): WeGIA SQL Injection vulnerability via 'id\_funcionario' param at endpoint \`/html/funcionario/dependente\_remover.php\` (CVSS 9.4)
- [CVE-2025-55171](https://cve.now/CVE-2025-55171.md): WeGIA Anonymous Attacker can Delete Arbitrary Image file at endpoint \`/html/personalizacao\_remover.php\` (CVSS 7.5)
- [CVE-2025-55170](https://cve.now/CVE-2025-55170.md): WeGIA reflected XSS via \`verificacao\` and \`redir\_config\` param at endpoint \`/html/alterar\_senha.php\` (CVSS 6.5)
- [CVE-2025-55169](https://cve.now/CVE-2025-55169.md): WeGIA Path Traversal at endpoint 'html/socio/sistema/download\_remessa.php' via parameter 'file' (CVSS 10.0)
- [CVE-2025-55168](https://cve.now/CVE-2025-55168.md): WeGIA SQL Injection via id\_fichamedica at endpoint \`GET /html/saude/aplicar\_medicamento.php\` (CVSS 9.4)
- [CVE-2025-55167](https://cve.now/CVE-2025-55167.md): WeGIA SQL Injection via id\_fichamedica at endpoint \`GET/html/funcionario/dependente\_remover.php\` (CVSS 9.4)
- [CVE-2025-54079](https://cve.now/CVE-2025-54079.md): WeGIA vulnerable to SQL Injection (Blind Time-Based) in endpoint 'Profile\_Atendido.php' parameter 'idatendido' (CVSS 9.4)
- [CVE-2025-54078](https://cve.now/CVE-2025-54078.md): WeGIA Reflected Cross-Site Scripting (XSS) vulnerability in endpoint 'personalizacao\_imagem.php' parameter 'err' (CVSS 6.5)
- [CVE-2025-54077](https://cve.now/CVE-2025-54077.md): WeGIA Reflected Cross-Site Scripting (XSS) vulnerability in endpoint 'personalizacao.php' parameter 'err' (CVSS 6.5)
- [CVE-2025-54076](https://cve.now/CVE-2025-54076.md): WeGIA Reflected Cross-Site Scripting (XSS) vulnerability in endpoint 'pre\_cadastro\_atendido.php' parameter 'msg\_e' (CVSS 6.5)
- [CVE-2025-54062](https://cve.now/CVE-2025-54062.md): WeGIA SQL Injection (Blind Time-Based) Vulnerability in id\_dependente Parameter on profile\_dependente.php Endpoint (CVSS 9.4)
- [CVE-2025-54061](https://cve.now/CVE-2025-54061.md): WeGIASQL Injection (Blind Time-Based) Vulnerability in idatendido\_familiares Parameter on dependente\_editarDoc.php Endpoint (CVSS 9.4)
- [CVE-2025-54060](https://cve.now/CVE-2025-54060.md): WeGIA SQL Injection (Blind Time-Based) Vulnerability in idatendido\_familiares Parameter on dependente\_editarInfoPessoal.php Endpoint (CVSS 9.4)
- [CVE-2025-54058](https://cve.now/CVE-2025-54058.md): WeGIA SQL Injection (Blind Time-Based) Vulnerability in idatendido\_familiares Parameter on dependente\_editarEndereco.php Endpoint (CVSS 9.4)
- [CVE-2025-53946](https://cve.now/CVE-2025-53946.md): WeGIA vulnerable to SQL Injection in endpoint profile\_paciente.php parameter id\_fichamedica (CVSS 9.4)
- [CVE-2025-53938](https://cve.now/CVE-2025-53938.md): WeGIA vulnerable to Authentication Bypass due to Missing Session Validation in multiple endpoints (CVSS 6.9)
- [CVE-2025-53937](https://cve.now/CVE-2025-53937.md): WeGIA has SQL Injection (Blind Time-Based) Vulnerability in \`cargo\` Parameter on \`control.php\` Endpoint (CVSS 9.4)
- [CVE-2025-53936](https://cve.now/CVE-2025-53936.md): WeGIA vulnerable to Reflected Cross-Site Scripting via endpoint \`personalizacao\_selecao.php\` parameter \`nome\_car\` (CVSS 6.4)
- [CVE-2025-53935](https://cve.now/CVE-2025-53935.md): WeGIA vulnerable to Reflected Cross-Site Scripting via endpoint \`personalizacao\_selecao.php\` parameter \`id\` (CVSS 6.4)
- [CVE-2025-53934](https://cve.now/CVE-2025-53934.md): WeGIA vulnerable to Stored Cross-Site Scripting via endpoint 'control.php' parameter 'descricao\_emergencia' (CVSS 6.4)
- [CVE-2025-53933](https://cve.now/CVE-2025-53933.md): WeGIA vulnerable to Stored Cross-Site Scripting via endpoint 'adicionar\_enfermidade.php' parameter 'nome' (CVSS 6.4)
- [CVE-2025-53932](https://cve.now/CVE-2025-53932.md): WeGIA vulnerable to Reflected Cross-Site Scripting via endpoint 'cadastro\_adotante.php' parameter 'cpf' (CVSS 6.4)
- [CVE-2025-53931](https://cve.now/CVE-2025-53931.md): WeGIA vulnerable to Stored Cross-Site Scripting via endpoint \`adicionar\_raca.php\` parameter \`raca\` (CVSS 6.4)
- [CVE-2025-53930](https://cve.now/CVE-2025-53930.md): WeGIA vulnerable to Stored Cross-Site Scripting (XSS) via endpoint 'adicionar\_especie.php' parameter 'especie' (CVSS 6.4)
- [CVE-2025-53929](https://cve.now/CVE-2025-53929.md): WeGIA vulnerable to Stored Cross-Site Scripting (XSS) via endpoint \`adicionar\_cor.php\` parameter \`cor\` (CVSS 6.4)
- [CVE-2025-53824](https://cve.now/CVE-2025-53824.md): WeGIA ReflectedCross-Site Scripting (XSS) vulnerability in endpoint 'cadastro\_pet.php' parameter 'msg' (CVSS 6.4)
- [CVE-2025-53823](https://cve.now/CVE-2025-53823.md): WeGIA vulnerable to SQL Injection (Blind Time-Based) in \`processa\_deletar\_socio.php\` parameter \`id\_socio\` (CVSS 10.0)
- [CVE-2025-53822](https://cve.now/CVE-2025-53822.md): WeGIA vulnerable to Reflected Cross-Site Scripting in endpoint 'relatorio\_geracao.php' parameter 'tipo\_relatorio' (CVSS 6.5)
- [CVE-2025-53821](https://cve.now/CVE-2025-53821.md): WeGIA vulnerable to Open Redirect in endpoint 'control.php' parameter 'nextPage' (CVSS 4.7)
- [CVE-2025-53820](https://cve.now/CVE-2025-53820.md): WeGIA vulnerable to Cross-Site Scripting (XSS) Reflected via endpoint 'index.php' parameter 'erro' (CVSS 6.5)
- [CVE-2025-53531](https://cve.now/CVE-2025-53531.md): WeGIA allows Uncontrolled Resource Consumption via the fid parameter (CVSS 8.7)
- [CVE-2025-53530](https://cve.now/CVE-2025-53530.md): WeGIA allows Uncontrolled Resource Consumption via the errorstr parameter (CVSS 8.7)
- [CVE-2025-53529](https://cve.now/CVE-2025-53529.md): WeGIA allows SQL Injection in html/funcionario/profile\_funcionario.php (id\_funcionario parameter) (CVSS 9.8)
- [CVE-2025-53527](https://cve.now/CVE-2025-53527.md): WeGIA allows Time-Based Blind SQL Injection in the relatorio\_geracao.php endpoint (CVSS 8.3)
- [CVE-2025-53526](https://cve.now/CVE-2025-53526.md): WeGIA allows Stored XSS attacks in novo\_memorando.php (CVSS 2.0)
- [CVE-2025-53525](https://cve.now/CVE-2025-53525.md): WebGia allows Cross-Site Scripting (XSS) in profile\_familiar.php via the id\_dependente parameter (CVSS 2.0)
- [CVE-2025-53377](https://cve.now/CVE-2025-53377.md): WebGia allows Cross-Site Scripting (XSS) in cadastro\_dependente\_pessoa\_nova.php via the id\_funcionario parameter (CVSS 2.0)
- [CVE-2025-53091](https://cve.now/CVE-2025-53091.md): WeGIA has Unauthenticated Time-Based Blind SQL Injection in almox Parameter (CVSS 10.0)
- [CVE-2025-6699](https://cve.now/CVE-2025-6699.md): LabRedesCefetRJ WeGIA Cadastro de Funcionário cadastro\_funcionario.php cross site scripting (CVSS 5.1)
- [CVE-2025-6698](https://cve.now/CVE-2025-6698.md): LabRedesCefetRJ WeGIA Adicionar tipo adicionar\_tipoSaida.php cross site scripting (CVSS 5.1)
- [CVE-2025-6697](https://cve.now/CVE-2025-6697.md): LabRedesCefetRJ WeGIA Adicionar tipo adicionar\_tipoEntrada.php cross site scripting (CVSS 5.1)
- [CVE-2025-6696](https://cve.now/CVE-2025-6696.md): LabRedesCefetRJ WeGIA Cadastro de Atendio Cadastro\_Atendido.php cross site scripting (CVSS 5.1)
- [CVE-2025-6695](https://cve.now/CVE-2025-6695.md): LabRedesCefetRJ WeGIA Additional Categoria adicionar\_categoria.php cross site scripting (CVSS 5.1)
- [CVE-2025-6694](https://cve.now/CVE-2025-6694.md): LabRedesCefetRJ WeGIA Adicionar Unidade adicionar\_unidade.php cross site scripting (CVSS 5.1)
- [CVE-2025-52474](https://cve.now/CVE-2025-52474.md): WeGIA SQL Injection Vulnerability in id Parameter on control.php Endpoint (CVSS 8.3)
- [CVE-2025-50201](https://cve.now/CVE-2025-50201.md): WeGIA OS Command Injection in debug\_info.php parameter 'branch' (CVSS 9.8)
- [CVE-2025-46828](https://cve.now/CVE-2025-46828.md): Unauthenticated SQL Injection on get\_socios.php endpoint (CVSS 10.0)
- [CVE-2025-30367](https://cve.now/CVE-2025-30367.md): WeGIA SQL Injection Vulnerability in nextPage Parameter on control.php Endpoint (CVSS 10.0)
- [CVE-2025-30366](https://cve.now/CVE-2025-30366.md): WeGIA vulnerable to Stored XSS in personalizacao.php (CVSS 6.2)
- [CVE-2025-30365](https://cve.now/CVE-2025-30365.md): SQL Injection in query\_geracao\_auto.php (CVSS 9.4)
- [CVE-2025-30364](https://cve.now/CVE-2025-30364.md): WeGIA vulnerable to SQL Injection (Blind Time-Based) in remuneracao.php parameter id\_funcionario (CVSS 10.0)
- [CVE-2025-30363](https://cve.now/CVE-2025-30363.md): WeGIA vulnerable to Stored XSS in documentos\_funcionario.php parameter dados\_addInfo (CVSS 6.4)
- [CVE-2025-30362](https://cve.now/CVE-2025-30362.md): WeGIA vulnerable to Stored XSS in documentos\_funcionario.php parameter id (CVSS 6.4)
- [CVE-2025-30361](https://cve.now/CVE-2025-30361.md): WeGIA Vulnerable to Broken Authentication - Old Password Validation (CVSS 9.3)
- [CVE-2025-29782](https://cve.now/CVE-2025-29782.md): WeGIA Cross-Site Scripting (XSS) Stored in endpoint \`adicionar\_tipo\_docs\_atendido.php\` parameter \`tipo\` (CVSS 6.4)
- [CVE-2025-27499](https://cve.now/CVE-2025-27499.md): WeGIA has a stored Cross-Site Scripting (XSS) in 'processa\_edicao\_socio.php' via the 'socio\_nome' parameter (CVSS 6.4)
- [CVE-2025-27419](https://cve.now/CVE-2025-27419.md): Denial of Service (DoS) in WeGIA due to Recursive Crawling of Dynamic URLs (CVSS 9.2)
- [CVE-2025-27420](https://cve.now/CVE-2025-27420.md): WeGIA contains a Stored Cross-Site Scripting (XSS) in 'atendido\_parentesco\_adicionar.php' via the 'descricao' parameter (CVSS 6.4)
- [CVE-2025-27418](https://cve.now/CVE-2025-27418.md): WeGIA contains a Stored Cross-Site Scripting (XSS) in 'adicionar\_tipo\_atendido.php' via the 'tipo' parameter (CVSS 6.4)
- [CVE-2025-27417](https://cve.now/CVE-2025-27417.md): WeGIA Contains a Stored Cross-Site Scripting (XSS) in 'adicionar\_status\_atendido.php' via the 'status' parameter (CVSS 6.4)
- [CVE-2025-27140](https://cve.now/CVE-2025-27140.md): WeGIA vulnerable to OS Command Injection at endpoint 'importar\_dump.php' parameter 'import' (RCE) (CVSS 10.0)
- [CVE-2025-27133](https://cve.now/CVE-2025-27133.md): WeGIA has SQL Injection endpoint at 'dao/pet/adicionar\_tipo\_exame.php' parameter 'tipo\_exame' (CVSS 9.4)
- [CVE-2025-27096](https://cve.now/CVE-2025-27096.md): SQL Injection endpoint 'html/personalizacao\_upload.php' parameter 'id\_campo' in WeGIA (CVSS 9.4)
- [CVE-2025-26605](https://cve.now/CVE-2025-26605.md): SQL Injection endpoint 'deletar\_cargo.php' parameter 'id\_cargo' in WeGIA (CVSS 9.4)
- [CVE-2025-26606](https://cve.now/CVE-2025-26606.md): SQL Injection endpoint 'informacao\_adicional.php' parameter 'id\_descricao' in WeGIA (CVSS 10.0)
- [CVE-2025-26607](https://cve.now/CVE-2025-26607.md): SQL Injection endpoint 'documento\_excluir.php' parameter 'id\_funcionario' in WeGIA (CVSS 10.0)
- [CVE-2025-26608](https://cve.now/CVE-2025-26608.md): SQL Injection endpoint 'dependente\_docdependente.php' parameter 'id\_dependente', 'id\_doc' in WeGIA (CVSS 10.0)
- [CVE-2025-26609](https://cve.now/CVE-2025-26609.md): SQL Injection endpoint 'familiar\_docfamiliar.php' parameter 'id\_dependente', 'id\_doc' in WeGIA (CVSS 10.0)
- [CVE-2025-26610](https://cve.now/CVE-2025-26610.md): SQL Injection endpoint 'restaurar\_produto\_desocultar.php' parameter 'id\_produto' in WeGIA (CVSS 9.4)
- [CVE-2025-26611](https://cve.now/CVE-2025-26611.md): SQL Injection endpoint 'remover\_produto.php' parameter 'id\_produto' in WeGIA (CVSS 10.0)
- [CVE-2025-26612](https://cve.now/CVE-2025-26612.md): SQL Injection endpoint 'adicionar\_almoxarife.php' parameter 'id\_almoxarifado', 'id\_funcionario' in WeGIA (CVSS 10.0)
- [CVE-2025-26613](https://cve.now/CVE-2025-26613.md): OS Command Injection endpoint 'gerenciar\_backup.php' parameter 'file' (RCE) in WeGIA (CVSS 10.0)
- [CVE-2025-26614](https://cve.now/CVE-2025-26614.md): SQL Injection endpoint 'deletar\_documento.php' parameter 'id\_cargo' in WeGIA (CVSS 9.4)
- [CVE-2025-26615](https://cve.now/CVE-2025-26615.md): Path Traversal endpoint 'examples.php' parameter 'src' in WeGIA (CVSS 10.0)
- [CVE-2025-26616](https://cve.now/CVE-2025-26616.md): Path Traversal endpoint 'exportar\_dump.php' parameter 'file' in WeGIA (CVSS 10.0)
- [CVE-2025-26617](https://cve.now/CVE-2025-26617.md): SQL Injection endpoint 'historico\_paciente.php' parameter 'id\_fichamedica' in WeGIA (CVSS 10.0)
- [CVE-2025-24901](https://cve.now/CVE-2025-24901.md): SQL Injection endpoint 'deletar\_permissao.php' parameter 'c', 'a', 'r' in WeGIA (CVSS 9.4)
- [CVE-2025-24902](https://cve.now/CVE-2025-24902.md): SQL Injection endpoint 'salvar\_cargo.php' parameter 'id\_cargo' in WeGIA (CVSS 9.4)
- [CVE-2025-24905](https://cve.now/CVE-2025-24905.md): SQL Injection endpoint 'get\_codigobarras\_cobranca.php' parameter 'codigo' in WeGIA (CVSS 10.0)
- [CVE-2025-24906](https://cve.now/CVE-2025-24906.md): SQL Injection endpoint 'get\_detalhes\_cobranca.php' parameter 'codigo' in WeGIA (CVSS 10.0)
- [CVE-2025-24957](https://cve.now/CVE-2025-24957.md): SQL Injection endpoint 'get\_detalhes\_socio.php' parameter 'id\_socio' in WeGIA (CVSS 10.0)
- [CVE-2025-24958](https://cve.now/CVE-2025-24958.md): SQL Injection endpoint 'salvar\_tag.php' parameter 'id\_tag' in WeGIA (CVSS 9.4)
- [CVE-2025-24020](https://cve.now/CVE-2025-24020.md): WeGIA Open Redirect vulnerability (CVSS 4.8)
- [CVE-2025-23220](https://cve.now/CVE-2025-23220.md): WeGIA has a SQL Injection endpoint 'adicionar\_raca.php' parameter 'raca' (CVSS 10.0)
- [CVE-2025-23219](https://cve.now/CVE-2025-23219.md): WeGIA has a SQL Injection endpoint 'adicionar\_cor.php' parameter 'cor' (CVSS 10.0)
- [CVE-2025-23218](https://cve.now/CVE-2025-23218.md): WeGIA has a SQL Injection endpoint 'adicionar\_especie.php' parameter 'especie' (CVSS 10.0)
- [CVE-2025-23038](https://cve.now/CVE-2025-23038.md): Cross-Site Scripting (XSS) Stored endpoint 'remuneracao.php ' parameter 'descricao' in WeGIA (CVSS 6.4)
- [CVE-2025-23030](https://cve.now/CVE-2025-23030.md): Cross-Site Scripting (XSS) Reflected endpoint 'cadastro\_funcionario.php' parameter 'cpf' in WeGIA (CVSS 6.4)
- [CVE-2025-23031](https://cve.now/CVE-2025-23031.md): Cross-Site Scripting (XSS) Stored endpoint 'adicionar\_alergia.php' parameter 'nome' in WeGIA (CVSS 6.4)
- [CVE-2025-23032](https://cve.now/CVE-2025-23032.md): Cross-Site Scripting (XSS) Stored endpoint 'adicionar\_escala.php' parameter 'escala' in WeGIA (CVSS 6.4)
- [CVE-2025-23033](https://cve.now/CVE-2025-23033.md): Cross-Site Scripting (XSS) Stored endpoint 'adicionar\_situacao.php' parameter 'situacao' in WeGIA (CVSS 6.4)
- [CVE-2025-23034](https://cve.now/CVE-2025-23034.md): Cross-Site Scripting (XSS) Reflected endpoint 'tags.php' parameter 'msg\_e' in WeGIA (CVSS 6.4)
- [CVE-2025-23035](https://cve.now/CVE-2025-23035.md): Cross-Site Scripting (XSS) Stored endpoint 'adicionar\_tipo\_quadro\_horario.php' parameter 'tipo' in WeGIA (CVSS 6.4)
- [CVE-2025-23036](https://cve.now/CVE-2025-23036.md): Cross-Site Scripting (XSS) Reflected endpoint 'pre\_cadastro\_funcionario.php' parameter 'msg\_e' in WeGIA (CVSS 6.4)
- [CVE-2025-23037](https://cve.now/CVE-2025-23037.md): Cross-Site Scripting (XSS) Stored endpoint 'control.php' parameter 'cargo' in WeGIA (CVSS 6.4)
- [CVE-2025-22613](https://cve.now/CVE-2025-22613.md): WeGIA Cross-Site Scripting (XSS) Stored endpoint 'informacao\_adicional.php' parameter 'descricao' (CVSS 6.4)
- [CVE-2025-22614](https://cve.now/CVE-2025-22614.md): WeGIA Cross-Site Scripting (XSS) Stored endpoint 'dependente\_editarInfoPessoal.php ' parameters 'nome' 'SobrenomeForm' (CVSS 6.4)
- [CVE-2025-22615](https://cve.now/CVE-2025-22615.md): WeGIA Cross-Site Scripting (XSS) Reflected endpoint 'Cadastro\_Atendido.php' parameter 'cpf' (CVSS 6.4)
- [CVE-2025-22616](https://cve.now/CVE-2025-22616.md): WeGIA Cross-Site Scripting (XSS) Stored endpoint 'dependente\_parentesco\_adicionar.php' parameter 'descricao' (CVSS 6.4)
- [CVE-2025-22617](https://cve.now/CVE-2025-22617.md): WeGIA Cross-Site Scripting (XSS) Reflected endpoint 'editar\_socio.php' parameter 'socio' (CVSS 6.4)
- [CVE-2025-22618](https://cve.now/CVE-2025-22618.md): WeGIA Cross-Site Scripting (XSS) Stored endpoint 'adicionar\_cargo.php' parameter 'cargo' (CVSS 6.4)
- [CVE-2025-22619](https://cve.now/CVE-2025-22619.md): WeGIA Cross-Site Scripting (XSS) Reflected endpoint 'editar\_permissoes.php' parameter 'msg\_c' (CVSS 6.4)
- [CVE-2025-22600](https://cve.now/CVE-2025-22600.md): WeGIA has a Cross-Site Scripting (XSS) Reflected endpoint \`configuracao\_doacao.php\` parameter \`avulso\` (CVSS 6.4)
- [CVE-2025-22599](https://cve.now/CVE-2025-22599.md): WeGIA has a Cross-Site Scripting (XSS) Reflected endpoint \`home.php\` parameter \`msg\_c\` (CVSS 6.4)
- [CVE-2025-22598](https://cve.now/CVE-2025-22598.md): WeGIA has a Cross-Site Scripting (XSS) Stored endpoint 'cadastrarSocio.php' parameter 'nome' (CVSS 8.3)
- [CVE-2025-22597](https://cve.now/CVE-2025-22597.md): WeGIA has a Cross-Site Scripting (XSS) Stored endpoint 'CobrancaController.php' parameter 'local\_recepcao' (CVSS 8.3)
- [CVE-2025-22596](https://cve.now/CVE-2025-22596.md): WeGIA has a Cross-Site Scripting (XSS) Reflected endpoint 'modulos\_visiveis.php' parameter'msg\_c' (CVSS 6.4)
- [CVE-2025-22143](https://cve.now/CVE-2025-22143.md): WeGIA Cross-Site Scripting (XSS) Reflected endpoint 'listar\_permissoes.php' parameter 'msg\_e' (CVSS 6.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/labredescefetrj
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.