Wegia maintains a single web-based product that, despite a narrow portfolio, has accumulated a moderate volume of reported vulnerabilities and occupies a notable position in the landscape. The vendor's disclosures skew toward serious outcomes, with an elevated share reaching critical severity, concentrated in a consistent set of application-layer weaknesses: cross-site scripting, SQL injection, open redirect, improper access control, and code injection vulnerabilities that reflect recurring input-handling and authorization gaps in web application code. These weakness classes are characteristic of web platforms with complex user-facing functionality, and their recurrence across Wegia's single product suggests structural pattern rather than isolated incidents. Defenders deploying this vendor's product should prioritize input validation, output encoding, and access-control hardening; current severity and exploitation activity are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Wegia over time
Signals from CVEs in this vendor scope (179 CVEs).
179 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2025-62360HIGH WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.Prior to 3.5.1, a SQL Injection vulnerability was identified in the /html/funcionario | Oct 13, 2025 | 8.8 | 41 | NO | YES |
CVE-2026-28409HIGH WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, a critical Remote Code Execution (RCE) vulnerability exists in the WeGIA application's database restorat | Feb 27, 2026 | 7.2 | 38 | NO | YES |
CVE-2026-28411CRITICAL WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, an unsafe use of the `extract()` function on the `$_REQUEST` superglobal allows an unauthenticated attac | Feb 27, 2026 | 9.8 | 34 | NO | NO |
CVE-2026-28408CRITICAL WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, the script in adicionar_tipo_docs_atendido.php does not go through the project's central controller and | Feb 27, 2026 | 9.8 | 34 | NO | NO |
CVE-2025-61603CRITICAL WeGIA is a Web manager for charitable institutions. Versions 3.4.12 and below include an SQL Injection vulnerability which was identified in the /controle/control.php endpoint, spe | Oct 2, 2025 | 9.8 | 34 | NO | NO |
CVE-2025-61605CRITICAL WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an SQL Injection vulnerability which was identified in the /pet/profi | Oct 2, 2025 | 9.8 | 32 | NO | NO |
CVE-2025-58745HIGH WeGIA is a Web manager for charitable institutions. The fix for CVE-2025-22133 was not enough to remediate the arbitrary file upload vulnerability. The WeGIA only check MIME types | Sep 8, 2025 | 8.8 | 32 | NO | NO |
CVE-2025-58159HIGH WeGIA is a Web manager for charitable institutions. Prior to version 3.4.11, a remote code execution vulnerability was identified, caused by improper validation of uploaded files. | Aug 29, 2025 | 8.8 | 32 | NO | NO |
CVE-2025-55169MEDIUM WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a path traversal vulnerability was discovered in th | Aug 12, 2025 | 6.5 | 32 | NO | YES |
CVE-2025-50201CRITICAL WeGIA is a web manager for charitable institutions. Prior to version 3.4.2, an OS Command Injection vulnerability was identified in the /html/configuracao/debug_info.php endpoint. | Jun 19, 2025 | 9.8 | 32 | NO | NO |
Signals from CVEs in this vendor scope (179 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Wegia.
Media articles that mention a CVE ID that affects a product developed by Wegia — matched by CVE ID, not by vendor name.