VYPR
← All advisories
Critical severity10.0NVD Advisory· Published Feb 27, 2026· Updated Jun 17, 2026

CVE-2026-28409

CVE-2026-28409

Description

WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, a critical Remote Code Execution (RCE) vulnerability exists in the WeGIA application's database restoration functionality. An attacker with administrative access (which can be obtained via the previously reported Authentication Bypass) can execute arbitrary OS commands on the server by uploading a backup file with a specifically crafted filename. Version 3.6.5 fixes the issue.

Affected products

3
  • Wegia/Wegia2 versions
    cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:*range: <3.6.5
    • (no CPE)range: <3.6.5
  • LabRedesCefetRJ/Wegiav5
    Range: < 3.6.5

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.