CVE-2026-28411Disclosure(wegia / wegia)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch wegia wegia systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, an unsafe use of the `extract()` function on the `$_REQUEST` superglobal allows an unauthenticated attacker to overwrite local variables in multiple PHP scripts. This vulnerability can be leveraged to completely bypass authentication checks, allowing unauthorized access to administrative and protected areas of the WeGIA application. Version 3.6.5 fixes the issue.

wegia CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Exploit / PoC references

https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-g7r9-hxc8-8vh7

Weakness type (CWE)

CWE-288CWE-473

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

wegia

Threat summary

Patch or workaround signal is available
10 mentions across 5 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 10 signals
Disclosure: 8 classified signals
Peaked 3d ago at 4 mentions (2026-02-28); latest day: 1
10 total mentions across 5 days

Affected systems

Vendors

wegia

Products

wegia

Deep dive

Activity timeline10 mentions / 5d

Signal classification2 categories

Disclosure

880.0%

Patch

220.0%

Referenced assets9 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-27	2	Disclosure1Patch1
2026-02-28	4	Disclosure3Patch1
2026-03-01	2	Disclosure2
2026-03-04	1	Disclosure1
2026-09-07	1	Disclosure1

Full discourse10 posts

pdnuclei-bot@pdnuclei_bot31d
Disclosure
🚨 CVE-2026-28411 - critical 🚨 WeGIA < 3.6.5 - Unauthenticated Authentication Bypass via extract() > WeGIA < 3.6.5 contains an authentication bypass caused by unsafe use of extract() on ... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-28411 @pdnuclei #NucleiTemplate...
Post summary
The post announces CVE-2026-28411 as a critical authentication bypass vulnerability in WeGIA < 3.6.5, providing a brief technical description but no PoC, exploit code, patches, or evidence of active exploitation.
01002447
1.3K followersView on X
The Hacker Wire@TheHackerWire223d
Disclosure
🔴 CVE-2026-28411 - Critical WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, an unsafe use of the `extract()` function on the `$_REQUEST` superglobal allows an unauthenticated attacker to ... https://www.thehackerwire.com/vulnerability/CVE-2026-28411/ https://t.co/hRYVdeUI15
Post summary
CVE-2026-28411 is a critical vulnerability in WeGIA that exploits an unsafe `extract()` call on `$_REQUEST`, but no PoC, exploit code, patch, or active exploitation details are provided.
1000062
119 followersView on X
CRAC Learning - Tech@cracbot218d
Disclosure
CVE-2026-28411 (CVSS:9.8, CRITICAL) is Analyzed. WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, an unsafe use of the `extract()` function on..https://nvd.nist.gov/vuln/detail/CVE-2026-28411 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post references CVE-2026-28411, noting its critical severity and unsafe use of extract() in WeGIA before v3.6.5, but provides no evidence of exploitation, PoC, or patch.
0000037
173 followersView on X
The AI generalist@AIengineerlife221d
Disclosure
🚨 CVE-2026-28411 - CRITICAL WeGIA 🤖 AI Summary: WeGIA web manager has a critical authentication bypass via unsafe extract() function. Unauthenticated attackers can gain admin access by ov... ThreatScore: 78/100 🔗 http://threatmonitor.io/cve/CVE-2026-28411 #cybersecurity #infosec #CVE
Post summary
The post announces CVE-2026-28411, a critical authentication bypass in WeGIA web manager via an unsafe extract() function, enabling unauthenticated admin access, but it does not provide a PoC, exploit, or patch information.
0000070
8 followersView on X
PulsePatch.io@pulsepatchio221d
Disclosure
A critical authentication bypass (CVE-2026-28411) affects `WeGIA` due to `extract($_REQUEST)` usage. Unauthorized access is possible. #PHP #AuthBypass #Infosec https://www.pulsepatch.io/posts/cve-2026-28411-wegia-authentication-bypass
Post summary
The post announces a critical authentication bypass vulnerability (CVE‑2026‑28411) in WeGIA caused by improper use of `extract($_REQUEST)`, allowing unauthorized access.
0000052
1 followersView on X
CVE@CVEnew222d
Disclosure
CVE-2026-28411 WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, an unsafe use of the `extract()` function on the `$_REQUEST` superglobal allows an unauthe… https://www.cve.org/CVERecord?id=CVE-2026-28411
Post summary
The text announces a vulnerability (CVE-2026-28411) in WeGIA web manager involving unsafe use of `extract()` on `$_REQUEST`, but provides no PoC, exploit, or patch details.
00000130
56.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds223d
Disclosure
CVE-2026-28411 WeGIA Authentication Bypass Vulnerability via Unsafe `extract()` Function Exploitation https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28411
Post summary
The text announces CVE-2026-28411 as an authentication bypass vulnerability in WeGIA caused by an unsafe extract() function, with no evidence of exploitation, PoC, or patch information.
0000056
4.0K followersView on X
OffSeq | Adversary Tactics for Cyber Resilience@offseq223d
Patch
🚨 CRITICAL: Auth bypass in LabRedesCefetRJ WeGIA (<3.6.5) lets attackers access admin & sensitive data! Patch to 3.6.5+ ASAP. 🛡️ Details: https://radar.offseq.com/threat/cve-2026-28411-cwe-288-authentication-bypass-using-7167a2c8 #OffSeq #Security #WebAppSec
Post summary
The post alerts to a critical authentication bypass (CVE‑2026‑28411) in LabRedesCefetRJ WeGIA versions <3.6.5, urges immediate patching to 3.6.5+, and provides no evidence of active exploitation or PoC.
0000050
270 followersView on X
OffSeq | Adversary Tactics for Cyber Resilience@offseq223d
Disclosure
Security Alert: CVE-2026-28411: CWE-288: Authentication Bypass Using an Alternate Path or Channel in LabRedesCefetRJ (CVE-2026-28411) https://radar.offseq.com/threat/cve-2026-28411-cwe-288-authentication-bypass-using-7167a2c8
Post summary
This alert announces the discovery of CVE-2026-28411, an authentication bypass vulnerability classified as CWE-288, without providing exploit details or patch information.
0000058
270 followersView on X
CVEFind.com@CveFindCom223d
Patch
[CVE-2026-28411: CRITICAL] WeGIA web manager had a security vulnerability in versions prior to 3.6.5, allowing attackers to bypass authentication and gain unauthorized access. Update to version 3.6.5 to fix.#cve,CVE-2026-28411,#cybersecurity https://cvefind.com/CVE-2026-28411
Post summary
The advisory reports a critical authentication bypass in WeGIA web manager before version 3.6.5 and recommends upgrading to 3.6.5 for remediation.
0000054
585 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	wegia	wegia	-	-	-

Explore more

Back to dashboard wegia CVEs wegia vulnerabilities

What researchers are saying

CVE-2026-28411

The AI generalist[verified]@AIengineerlifeDisclosure

The post announces CVE-2026-28411, a critical authentication bypass in WeGIA web manager via an unsafe extract() function, enabling unauthenticated admin access, but it does not provide a PoC, exploit, or patch information.

OffSeq | Adversary Tactics for Cyber Resilience[verified]@offseqPatch

The post alerts to a critical authentication bypass (CVE‑2026‑28411) in LabRedesCefetRJ WeGIA versions <3.6.5, urges immediate patching to 3.6.5+, and provides no evidence of active exploitation or PoC.

OffSeq | Adversary Tactics for Cyber Resilience[verified]@offseqDisclosure

This alert announces the discovery of CVE-2026-28411, an authentication bypass vulnerability classified as CWE-288, without providing exploit details or patch information.

pdnuclei-bot@pdnuclei_botDisclosure

The post announces CVE-2026-28411 as a critical authentication bypass vulnerability in WeGIA < 3.6.5, providing a brief technical description but no PoC, exploit code, patches, or evidence of active exploitation.

The Hacker Wire@TheHackerWireDisclosure

CVE-2026-28411 is a critical vulnerability in WeGIA that exploits an unsafe `extract()` call on `$_REQUEST`, but no PoC, exploit code, patch, or active exploitation details are provided.

CRAC Learning - Tech@cracbotDisclosure

The post references CVE-2026-28411, noting its critical severity and unsafe use of extract() in WeGIA before v3.6.5, but provides no evidence of exploitation, PoC, or patch.

PulsePatch.io@pulsepatchioDisclosure

The post announces a critical authentication bypass vulnerability (CVE‑2026‑28411) in WeGIA caused by improper use of `extract($_REQUEST)`, allowing unauthorized access.

CVE@CVEnewDisclosure

The text announces a vulnerability (CVE-2026-28411) in WeGIA web manager involving unsafe use of `extract()` on `$_REQUEST`, but provides no PoC, exploit, or patch details.