Vulnerability Research on Natan Maia Morette

CVE-2026-82801: Unauthenticated SSRF and Internal Host Discovery in NASA Earthdata Search

Mon, 31 Aug 2026 00:00:00 -0300

⚠ Replicated advisory. This post reproduces an advisory originally researched and published under the Thoropass Vulnerability Research Program. It is republished here for reference. The original disclosure followed coordinated vulnerability disclosure and the rules of the CVE Program.

🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-82801%20-%20NASA%20Earthdata%20Search%20-%20Unauthenticated%20SSRF%20and%20Internal%20Host%20Discovery%20via%20Scale%20Image%20Endpoint
📋 CVE record: CVE-2026-82801

Advisory Information


Researcher	Natan Morette on behalf of Thoropass
Product	NASA Earthdata Search - web application developed by NASA EOSDIS for discovering, visualizing, and downloading Earth science data
Affected Version	1.0.0 and all prior versions (master HEAD `bd935b23f`)
Endpoint	`serverless/src/scaleImage/handler.js`, `scaleImage` (route `GET /scale`)
Vulnerability Type	CWE-918: Server-Side Request Forgery (SSRF)
CVSS 3.1	5.3 Medium - `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`
CVE ID	CVE-2026-82801

Vulnerability Summary

GET /scale?imageSrc=<URL> makes the server fetch any attacker-supplied URL, with no authentication and no validation of the URL. On its own this looks like a harmless blind SSRF, the response is always the same default image. It is not harmless. Because the endpoint runs inside NASA’s cloud environment, the same primitive lets an unauthenticated attacker use the server as a proxy into the internal network it sits in, and the response timing reveals which internal, otherwise-unreachable hosts are alive. An external attacker maps the internal network one request at a time.

CVE-2026-82802: Unauthenticated Response-Reflecting SSRF in NASA Earthdata Search (OpenSearch granule endpoint)

Mon, 31 Aug 2026 00:00:00 -0300

🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-82802%20-%20NASA%20Earthdata%20Search%20-%20Unauthenticated%20Response-Reflecting%20SSRF%20in%20OpenSearch%20Granule%20Endpoint
📋 CVE record: CVE-2026-82802

Advisory Information


Researcher	Natan Morette on behalf of Thoropass
Product	NASA Earthdata Search - web application developed by NASA EOSDIS for discovering, visualizing, and downloading Earth science data
Affected Version	1.0.0 and all prior versions (master HEAD `bd935b23f`)
Endpoint	`serverless/src/openSearchGranuleSearch/handler.js`, `openSearchGranuleSearch` (route `POST /opensearch/granules`)
Vulnerability Type	CWE-918: Server-Side Request Forgery (SSRF)
CVSS 3.1	5.3 Medium - `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`
CVE ID	CVE-2026-82802

Vulnerability Summary

POST /opensearch/granules takes a caller-supplied openSearchOsdd URL, fetches it server-side, pulls a template URL out of the returned OpenSearch Description Document, fetches that too, and returns the raw second-hop response body to the caller. Both fetches are attacker-controlled, the route uses an optional authorizer so anonymous requests reach the handler, and neither fetch validates scheme, host, or IP. Because the raw body is reflected verbatim, an unauthenticated attacker does not just reach internal resources, it reads them: the endpoint is a full read primitive for any internal service that answers with text, HTML, or XML.

CVE-2026-12188: grit42 — SQL Injection in CSV Export Endpoint

Sun, 14 Jun 2026 00:00:00 -0300

🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-12188%20-%20grit42%20-%20SQL%20Injection%20in%20CSV%20Export%20Endpoint
📋 CVE record: CVE-2026-12188

Advisory Information


Researcher	Natan Morette on behalf of Thoropass
Product	grit - Open-source scientific research data management platform built by grit42 A/S. The platform stores and visualises data from pre-clinical drug discovery workflows: compounds, batches, assay models, experiment results, and dynamically-typed data tables.
Affected Version	0.0.x through 0.11.0 (every public release; sink introduced in initial commit `79b9dfa`)
Endpoint	`GET /api/grit/<engine>/<resource>/export` (any resource declared with `resources_with_export`)
Vulnerability Type	CWE-89: SQL Injection
CVE ID	CVE-2026-12188

Vulnerability Summary

The CSV export action in grit’s GritEntityController splats the user-controlled params[:columns] into Model.unscoped.select(*params[:columns]), then wraps the resulting relation in a PostgreSQL COPY (...) TO STDOUT WITH CSV HEADER statement. Rails’ select accepts raw SQL fragments, so any authenticated user can inject sub-selects into the SELECT clause and exfiltrate any column the database role can see.

CVE-2026-7680: COCO Annotator — Path Traversal via Dataset Folder Parameter

Sun, 03 May 2026 00:00:00 -0300

🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-7680%20-%20COCO%20Annotator%20-%20Path%20Traversal%20via%20Dataset%20Folder%20Parameter
📋 CVE record: CVE-2026-7680

Advisory Information


Researcher	Natan Morette on behalf of Thoropass
Product	COCO Annotator - Open-source, web-based image annotation platform used to build datasets for computer vision and machine learning workflows, supporting the COCO dataset format.
Affected Version	v0.11.1 and all prior versions
Endpoint	`backend/webserver/api/datasets.py` — `DatasetDataId` endpoint
Vulnerability Type	CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)
CVE ID	CVE-2026-7680

Vulnerability Summary

A path traversal vulnerability exists in the COCO Annotator dataset browsing API. The GET /api/dataset/<id>/data endpoint accepts a folder query parameter that is concatenated into a filesystem path without proper sanitization or containment validation.

CVE-2026-7681: COCO Annotator — Unauthenticated Dataset Modification via Missing Authentication

Sun, 03 May 2026 00:00:00 -0300

🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-7681%20-%20COCO%20Annotator%20-%20Unauthenticated%20Dataset%20Modification%20via%20Missing%20Authentication
📋 CVE record: CVE-2026-7681

Advisory Information


Researcher	Natan Morette on behalf of Thoropass
Product	COCO Annotator - Open-source, web-based image annotation platform used to build datasets for computer vision and machine learning workflows, supporting the COCO dataset format.
Affected Version	v0.11.1 and all prior versions
Endpoint	`backend/webserver/api/datasets.py` — `DatasetId` resource, `POST` method
Vulnerability Type	CWE-306: Missing Authentication for Critical Function
CVE ID	CVE-2026-7681

Vulnerability Summary

A missing authentication vulnerability exists in the COCO Annotator dataset management API. The POST /api/dataset/<id> endpoint, which updates a dataset’s categories and default annotation metadata, is missing the @login_required decorator. This allows any unauthenticated, anonymous attacker to modify any dataset in the system with a single HTTP request — no credentials, no session cookie, and no token required.

CVE-2026-2108: COCO Annotator — Unauthenticated Denial of Service via Task Queue Flood

Sat, 07 Feb 2026 00:00:00 -0300

🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-2108%20-%20COCO%20Annotator%20-%20Unauthenticated%20Denial%20of%20Service%20via%20Task%20Queue%20Flood
📋 CVE record: CVE-2026-2108

Advisory Information


Researcher	Natan Morette on behalf of Thoropass
Product	COCO Annotator - Open-source, web-based image annotation platform used to build datasets for computer vision and machine learning workflows, supporting the COCO dataset format.
Affected Version	0.11.1
Endpoint	`/api/info/long_task`
Vulnerability Type	CWE-306: Missing Authentication for Critical Function; CWE-400: Uncontrolled Resource Consumption
CVE ID	CVE-2026-2108

Vulnerability Summary

The endpoint /api/info/long_task is exposed without authentication or rate limiting, and allows any remote user to enqueue Celery background tasks and write entries to the database (TaskModel) on every request.

CVE-2026-2109: COCO Annotator — Broken Function Level Authorization in Undo Endpoint

Sat, 07 Feb 2026 00:00:00 -0300

🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-2109%20-%20COCO%20Annotator%20-%20Broken%20Function%20Level%20Authorization%20in%20Undo%20Endpoint
📋 CVE record: CVE-2026-2109

Advisory Information


Researcher	Natan Morette on behalf of Thoropass
Product	COCO Annotator - Open-source, web-based image annotation platform used to build datasets for computer vision and machine learning workflows, supporting the COCO dataset format.
Affected Version	0.11.1
Endpoint	`/api/undo/`
Vulnerability Type	CWE-285: Improper Authorization (Broken Function Level Authorization)
CVE ID	CVE-2026-2109

Vulnerability Summary

An attacker can delete categories created by other users via a DELETE request to the /api/undo/ endpoint without any ownership or permission checks. This constitutes a Broken Function Level Authorization (BFLA) vulnerability, allowing unauthorized manipulation of protected resources.

CVE-2026-2064: i-Educar — Stored XSS via Profile Picture Upload

Fri, 06 Feb 2026 00:00:00 -0300

🔗 Original advisory: https://github.com/heylaika/vuln-research-program/tree/main/2026/CVE-2026-2064%20-%20i-Educar%20-%20Stored%20XSS%20via%20Profile%20Picture%20Upload
📋 CVE record: CVE-2026-2064

Advisory Information


Researcher	Natan Morette on behalf of Thoropass
Product	i-Educar - Open-source, web-based school management system widely used by public education institutions in Brazil to manage academic and administrative data in real time.
Affected Version	2.10.0
Endpoint	`/intranet/meusdadod.php`
Vulnerability Type	CWE-79: Improper Neutralization of Input During Web Page Generation (Stored Cross-Site Scripting)
CVE ID	CVE-2026-2064

Vulnerability Summary

The /intranet/meusdadod.php endpoint allows authenticated users to upload profile pictures (avatars) without proper file type validation or content sanitization. By exploiting the lack of server-side MIME type verification and file content inspection, an attacker can upload a malicious SVG file containing embedded JavaScript code disguised as a legitimate image file.

CVE-2025-9823: Reflected XSS in lead:addLeadTags - Quick Add

Wed, 03 Sep 2025 00:00:00 -0300

⚠ Replicated advisory. This post reproduces an advisory originally researched and published under the CVE Hunters. It is republished here for reference. The original disclosure followed coordinated vulnerability disclosure and the rules of the CVE Program.

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-9823/
📋 CVE record: CVE-2025-9823

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-9823

Vendor

Mautic is an open-source marketing automation platform used worldwide.

https://mautic.org/

Affected Product Code Base

Affected versions:

= 4.4.0, < 4.4.17 = 5.0.0-alpha, < 5.2.8 = 6.0.0-alpha, < 6.0.5 Patched versions: 4.4.17, 5.2.8, 6.0.5

CVE-2025-9404: Storage Cross-Site Scripting (XSS) in endpoint pointHIerarchySLTS parameter title

Mon, 25 Aug 2025 00:00:00 -0300

🔗 Original advisory: https://github.com/CVE-Hunters/CVE/blob/main/Scada-LTS/Stored%20XSS%20endpoint%20pointHierarchySLTS%20parameter%20title.md
📋 CVE record: CVE-2025-9404

Summary

Stored Cross-Site Scripting (XSS) vulnerability was identified in the pointHIerarchySLTS endpoint. This vulnerability allows attackers to inject malicious scripts into the username parameter. The injected scripts are stored on the server and executed automatically whenever the page pointHIerarchySLTS is accessed by users, posing a significant security risk.

CVE-2025-9139: Sensitive User Information Disclosure via WatchListDwr.init.dwr Endpoint

Tue, 19 Aug 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-9139/
📋 CVE record: CVE-2025-9139

Summary

A vulnerability was identified in the WatchListDwr.init.dwr endpoint of SCADA-LTS that allows any authenticated user, even with minimal permissions, to access sensitive user information including usernames, emails, phone numbers, and admin status. This flaw constitutes an Information Disclosure issue and could be used to facilitate further attacks such as phishing, privilege escalation, or social engineering.

CVE-2025-8789: Broken Function Level Authorization (BFLA) allows unauthorized users to alter student grades

Sun, 10 Aug 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-8789/
📋 CVE record: CVE-2025-8789

Summary

An API endpoint in i-Educar 2.9.0 is vulnerable to Broken Function Level Authorization (BFLA). An unauthorized user is able to modify student grades by directly accessing the /module/Api/Diario endpoint, bypassing permission controls. This leads to severe integrity issues, where anyone with access to the API format can tamper with academic records.

CVE-2025-8790: Broken Object Level Authorization (BOLA) in pessoa API Endpoint Allows Unauthorized Access to Other Users Data

Sun, 10 Aug 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-8790/
📋 CVE record: CVE-2025-8790

Summary

A Broken Object Level Authorization (BOLA) vulnerability was identified in the i-educar 2.8 and 2.9 API, allowing any authenticated low-privileged user to access sensitive information from other users by manipulating the id parameter in the pessoa resource endpoint.

CVE-2025-8510: Reflected Cross-Site Scripting (XSS) in educar_matricula_lst.php via ref_cod_aluno Parameter

Sun, 03 Aug 2025 00:00:00 -0300

🔗 Original advisory: https://github.com/CVE-Hunters/CVE/blob/main/i-educar/CVE-2025-8510%20.md
📋 CVE record: CVE-2025-8510

Summary

A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the atendidos_cad.php endpoint of the i-educar application 2.10. This vulnerability allows attackers to inject malicious scripts in the ref_cod_alunoparameter.

Details

Vulnerable Endpoint: educar_matricula_lst.php Parameter: ref_cod_aluno

CVE-2025-8346: Cross-Site Scripting (XSS) Reflected endpoint educar_aluno_lst.php via ref_cod_matricula parameter

Thu, 31 Jul 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-8346/
📋 CVE record: CVE-2025-8346

Summary

A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the educar_aluno_lst.php endpoint of the i-Educar application. This vulnerability allows attackers to inject malicious scripts into the ref_cod_matricula parameter.

Details

Vulnerable Endpoint: educar_aluno_lst.php

CVE-2025-8365: Multiples Cross-Site Scripting (XSS) Stored in endpoint atendidos_cad.php

Thu, 31 Jul 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-8365/
📋 CVE record: CVE-2025-8365

Summary

Multiples Stored Cross-Site Scripting (XSS) vulnerabilities was identified in the atendidos_cad.php endpoint of the i-Educar application. This vulnerability allows attackers to inject malicious scripts into the nome, nome_social and email parameters. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk.

CVE-2025-7870: Cross-Site Scripting (XSS) Storage Injection via SVG Upload

Sun, 20 Jul 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-7870/
📋 CVE record: CVE-2025-7870

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-7870

Summary

An attacker can upload a malicious SVG file containing embedded JavaScript that is executed when the file is accessed directly. This results in Stored Cross-Site Scripting (XSS).

CVE-2025-7871: Cross-Site Scripting (XSS) Reflected endpoint conteudos parameter filter[by_description]

Sun, 20 Jul 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-7871/
📋 CVE record: CVE-2025-7871

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-7871

Summary

A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the conteudos endpoint of the i-Diário application. This vulnerability allows attackers to inject malicious scripts into the filter[by_description] parameter.

CVE-2025-7728: Cross-Site Scripting (XSS) Stored endpoint users.shtm parameter username

Thu, 17 Jul 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-7728/
📋 CVE record: CVE-2025-7728

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-7728

Summary

A Stored Cross-Site Scripting (XSS) vulnerability was identified in the users.shtm endpoint of the Scada-LTS application. This vulnerability allows attackers to inject malicious scripts into the usernameparameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk.

CVE-2025-7729: Cross-Site Scripting (XSS) Stored endpoint usersProfiles.shtm parameter userprofilename

Thu, 17 Jul 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-7729/
📋 CVE record: CVE-2025-7729

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-7729

Summary

A Stored Cross-Site Scripting (XSS) vulnerability was identified in the usersProfiles.shtm endpoint of the Scada-LTS application. This vulnerability allows attackers to inject malicious scripts into the userprofilenameparameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk.

CVE-2025-53527: SQL Injection Vulnerability in tipo and responsavel Parameters on relatorio_geracao.php Endpoint

Mon, 07 Jul 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-53527/
📋 CVE record: CVE-2025-53527

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-53527

Summary

A SQL Injection vulnerability was identified in the tipo and responsavel parameters of the /controle/relatorio_geracao.php endpoint. This vulnerability allows attacker to manipulate SQL queries and access sensitive database information, such as table names and sensitive data.

CVE-2025-53091: Unauthenticated Time-Based SQL Injection Vulnerability in almox Parameter

Fri, 27 Jun 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-53091/
📋 CVE record: CVE-2025-53091

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-53091

Summary

A Time-Based Blind SQL Injection vulnerability was discovered in the almox parameter of the /controle/getProdutosPorAlmox.php endpoint. This issue allows any unauthenticated attacker to inject arbitrary SQL queries, potentially leading to unauthorized data access or further exploitation depending on database configuration.

CVE-2025-52474: SQL Injection Vulnerability in id Parameter on control.php Endpoint

Thu, 19 Jun 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-52474/
📋 CVE record: CVE-2025-52474

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-52474

Summary

A SQL Injection vulnerability was identified in the id parameter of the /WeGIA/controle/control.php endpoint. This vulnerability allows attacker to manipulate SQL queries and access sensitive database information, such as table names and sensitive data.

CVE-2025-30366: Multiples Stored XSS in personalizacao.php

Thu, 27 Mar 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-30366/
📋 CVE record: CVE-2025-30366

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-30366

Summary

Multiples stored Cross-Site Scripting (XSS) vulnerability was identified in the WeGIA application. This vulnerability allows unauthorized scripts to be executed within the user's browser context. Stored XSS is particularly critical, as the malicious code is permanently stored on the server and executed whenever a compromised page is loaded, affecting all users accessing this page.

CVE-2025-30367: SQL Injection endpoint control.php parameter nextPage

Thu, 27 Mar 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-30367/
📋 CVE record: CVE-2025-30367

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-30367

Summary

A SQL Injection vulnerability was identified in the WeGIA application, specifically in the control.php endpoint. This vulnerability allows attackers to execute arbitrary SQL commands in the database, allowing unauthorized access to sensitive information. During the exploit, it was possible to perform a complete dump of the application's database, highlighting the severity of the flaw.

CVE-2024-57030: Cross-Site Scripting (XSS) Stored in documentos_funcionario.php parameter id

Fri, 17 Jan 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2024-57030/
📋 CVE record: CVE-2024-57030

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2024-57030

Vendor

WeGIA (Web Gerenciador Institucional) is an integrated management system licensed under the GNU GPL v3.0, designed to enhance administration, control, and transparency for institutions.

https://www.wegia.org

https://sol.sbc.org.br/index.php/latinoware/article/view/31544

CVE-2024-57031: SQL Injection (Blind Time-Based) in remuneracao.php parameter id_funcionario

Fri, 17 Jan 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2024-57031/
📋 CVE record: CVE-2024-57031

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2024-57031

Vendor

WeGIA (Web Gerenciador Institucional) is an integrated management system licensed under the GNU GPL v3.0, designed to enhance administration, control, and transparency for institutions.

https://www.wegia.org

https://sol.sbc.org.br/index.php/latinoware/article/view/31544

CVE-2024-57032: Broken Authentication - Old Password

Fri, 17 Jan 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2024-57032/
📋 CVE record: CVE-2024-57032

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2024-57032

Vendor

WeGIA (Web Gerenciador Institucional) is an integrated management system licensed under the GNU GPL v3.0, designed to enhance administration, control, and transparency for institutions.

https://www.wegia.org

https://sol.sbc.org.br/index.php/latinoware/article/view/31544

CVE-2024-57033: Cross-Site Scripting (XSS) Stored in documentos_funcionario.php parameter dados_addInfo

Fri, 17 Jan 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2024-57033/
📋 CVE record: CVE-2024-57033

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2024-57033

Vendor

WeGIA (Web Gerenciador Institucional) is an integrated management system licensed under the GNU GPL v3.0, designed to enhance administration, control, and transparency for institutions.

https://www.wegia.org

https://sol.sbc.org.br/index.php/latinoware/article/view/31544

CVE-2024-57034: SQL Injection in query_geracao_auto.php

Fri, 17 Jan 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2024-57034/
📋 CVE record: CVE-2024-57034

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2024-57034

Vendor

WeGIA (Web Gerenciador Institucional) is an integrated management system licensed under the GNU GPL v3.0, designed to enhance administration, control, and transparency for institutions.

https://www.wegia.org

https://sol.sbc.org.br/index.php/latinoware/article/view/31544

CVE-2024-57035: SQL Injection Vulnerability in nextPage Parameter on control.php Endpoint

Fri, 17 Jan 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2024-57035/
📋 CVE record: CVE-2024-57035

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2024-57035

Vendor

WeGIA (Web Gerenciador Institucional) is an integrated management system licensed under the GNU GPL v3.0, designed to enhance administration, control, and transparency for institutions.

https://www.wegia.org

https://sol.sbc.org.br/index.php/latinoware/article/view/31544

CVE-2025-22599: Cross-Site Scripting (XSS) Reflected endpoint home.php parameter msg_c

Fri, 10 Jan 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-22599/
📋 CVE record: CVE-2025-22599

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-22599

Summary

A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the home.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_c parameter.

CVE-2025-22600: Cross-Site Scripting (XSS) Reflected endpoint configuracao_doacao.php parameter avulso

Fri, 10 Jan 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-22600/
📋 CVE record: CVE-2025-22600

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-22600

Summary

A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the configuracao_doacao.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the avulso parameter.

CVE-2025-22139: Cross-Site Scripting (XSS) Reflected endpoint configuracao_geral.php parameter msg

Wed, 08 Jan 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-22139/
📋 CVE record: CVE-2025-22139

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-22139

Summary

A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the configuracao_geral.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_c parameter.

CVE-2025-22132: Cross-Site Scripting (XSS) in File Upload Field

Tue, 07 Jan 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-22132/
📋 CVE record: CVE-2025-22132

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-22132

Vendor

WeGIA (Web Gerenciador Institucional) is an integrated management system licensed under the GNU GPL v3.0, designed to enhance administration, control, and transparency for institutions.

https://www.wegia.org

https://sol.sbc.org.br/index.php/latinoware/article/view/31544

CVE-2025-22133: Arbitrary File Upload with Remote Code Execution (RCE)

Tue, 07 Jan 2025 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2025-22133/
📋 CVE record: CVE-2025-22133

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2025-22133

Summary

A critical vulnerability was identified in the following endpoint:

/WeGIA/html/socio/sistema/controller/controla_xlsx.php

The endpoint accepts file uploads without proper validation, allowing the upload of malicious files, such as .phar, which can then be executed by the server.

CVE-2024-53473: Broken Access Control

Sat, 07 Dec 2024 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2024-53473/
📋 CVE record: CVE-2024-53473

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2024-53473

Vendor

WeGIA (Web Gerenciador Institucional) is an integrated management system licensed under the GNU GPL v3.0, designed to enhance administration, control, and transparency for institutions.

https://www.wegia.org

https://sol.sbc.org.br/index.php/latinoware/article/view/31544

CVE-2024-53470: Stored XSS in gateway_pagamento.php function

Thu, 05 Dec 2024 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2024-53470/
📋 CVE record: CVE-2024-53470

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2024-53470

Vendor

WeGIA (Web Gerenciador Institucional) is an integrated management system licensed under the GNU GPL v3.0, designed to enhance administration, control, and transparency for institutions.

https://www.wegia.org

https://sol.sbc.org.br/index.php/latinoware/article/view/31544

CVE-2024-53471: Stored XSS in meio_pagamento.php function

Thu, 05 Dec 2024 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2024-53471/
📋 CVE record: CVE-2024-53471

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2024-53471

Vendor

WeGIA (Web Gerenciador Institucional) is an integrated management system licensed under the GNU GPL v3.0, designed to enhance administration, control, and transparency for institutions.

https://www.wegia.org

https://sol.sbc.org.br/index.php/latinoware/article/view/31544

CVE-2024-53472: CSRF in control.php to change password

Thu, 05 Dec 2024 00:00:00 -0300

🔗 Original advisory: https://www.cvehunters.com/p/cve-2024-53472/
📋 CVE record: CVE-2024-53472

CVE Publication: https://www.cve.org/CVERecord?id=CVE-2024-53472

Vendor

WeGIA (Web Gerenciador Institucional) is an integrated management system licensed under the GNU GPL v3.0, designed to enhance administration, control, and transparency for institutions.

https://www.wegia.org

https://sol.sbc.org.br/index.php/latinoware/article/view/31544