CVE-2026-28411

critical · 9.8

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, an unsafe use of the `extract()` function on the `$_REQUEST` superglobal allows an unauthenticated attacker to overwrite local variables in multiple PHP scripts. This vulnerability can be leveraged to completely bypass authentication checks, allowing unauthorized access to administrative and protected areas of the WeGIA application. Version 3.6.5 fixes the issue.

9.8

CVSS

2.3%

EPSS (exploit prob.)

83rd

EPSS percentile

2026-02-27

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-288CWE-473

Affected products

Vendor	Product	Affected versions
wegia	wegia	< 3.6.5

Check a specific version with /api/v1/cve/match.

References

https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-g7r9-hxc8-8vh7

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-28411