Arthurvel

**Name of the Vulnerable Software and Affected Versions** WeGIA versions prior to 3.7.0 **Description** The software displays overly descriptive error messages containing database-related details through the 'atendido/familiar docfamiliar.php' endpoint. This information disclosure can be used to map the backend infrastructure and expand the attack surface. **Recommendations** Update to version 3.7.0.

**Name of the Vulnerable Software and Affected Versions** WeGIA versions prior to 3.7.0 **Description** A Stored Cross-Site Scripting (XSS) flaw exists, which allows a malicious script to be persistently stored on the server. This occurs at the 'funcionario/profile funcionario.php?id funcionario=2' endpoint when a payload is injected into the `Description` field and the profile is saved. The script executes automatically whenever the profile page is accessed. **Recommendations** Update to version 3.7.0.

**Name of the Vulnerable Software and Affected Versions** WeGIA versions prior to 3.6.10 **Description** An information disclosure issue exists when uploading files with malicious content to the 'funcionario/docdependente upload.php' endpoint. The application returns overly descriptive error messages, providing technical insights that can be used to refine attacks. **Recommendations** Update to version 3.6.10.