How many CVEs have patched incluir?

18 published CVEs changed incluir in LabRedesCefetRJ/WeGIA, in 15 distinct patches totalling 4,587 changed lines, between 2025 and 2026.

What is the latest CVE that changed incluir?

CVE-2026-54767 (WeGIA: Hardcoded Secret Key Backdoor — Mass Data Destruction via deletar_socios.php), published 2026-09-17, changed lines 91 to 92 of web/controle/InternoControle.php.

How does incluir compare to the rest of LabRedesCefetRJ/WeGIA?

LabRedesCefetRJ/WeGIA has 82 CVEs with a located fix in total; 18 of them changed incluir.

What do the line numbers refer to?

Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

incluir in LabRedesCefetRJ/WeGIA: Patched by 18 CVEs

WeGIA: Hardcoded Secret Key Backdoor — Mass Data Destruction via deletar_socios.php

CVE-2026-54767 · web/controle/InternoControle.php · lines 91–92 · +2 −0

Critical · CVSS 9.1

EPSS 0.8%2026-09-17

WeGIA: Authorization Bypass via Empty Resource Array in InternoControle

CVE-2026-54671 · web/controle/InternoControle.php · lines 91–92 · +4 −0 in 2 hunks

High · CVSS 8.8

EPSS 0.6%2026-09-17

WeGIA Clickjacking Vulnerability

CVE-2026-23731 · controle/Atendido_ocorrenciaControle.php · lines 69–129 · +53 −53

Medium · CVSS 4.3

EPSS 0.3%2026-01-16

WeGIA Clickjacking Vulnerability

CVE-2026-23731 · dao/DestinoDAO.php · lines 9–66 · +47 −64

Medium · CVSS 4.3

EPSS 0.3%2026-01-16

WeGIA Clickjacking Vulnerability

CVE-2026-23731 · dao/ProdutoDAO.php · lines 17–51 · +20 −67

Medium · CVSS 4.3

EPSS 0.3%2026-01-16

WeGIA Clickjacking Vulnerability

CVE-2026-23731 · dao/TipoEntradaDAO.php · lines 9–72 · +42 −46

Medium · CVSS 4.3

EPSS 0.3%2026-01-16

WeGIA Clickjacking Vulnerability

CVE-2026-23731 · dao/TipoSaidaDAO.php · lines 9–62 · +43 −58

Medium · CVSS 4.3

EPSS 0.3%2026-01-16

WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=ProdutoControle)

CVE-2026-23730 · controle/Atendido_ocorrenciaControle.php · lines 69–129 · +53 −53

Medium · CVSS 4.8

EPSS 0.2%2026-01-16

WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=ProdutoControle)

CVE-2026-23730 · dao/DestinoDAO.php · lines 9–66 · +47 −64

Medium · CVSS 4.8

EPSS 0.2%2026-01-16

WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=ProdutoControle)

CVE-2026-23730 · dao/ProdutoDAO.php · lines 17–51 · +20 −67

Medium · CVSS 4.8

EPSS 0.2%2026-01-16

WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=ProdutoControle)

CVE-2026-23730 · dao/TipoEntradaDAO.php · lines 9–72 · +42 −46

Medium · CVSS 4.8

EPSS 0.2%2026-01-16

WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=ProdutoControle)

CVE-2026-23730 · dao/TipoSaidaDAO.php · lines 9–62 · +43 −58

Medium · CVSS 4.8

EPSS 0.2%2026-01-16

WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarDescricao, nomeClasse=ProdutoControle)

CVE-2026-23729 · controle/Atendido_ocorrenciaControle.php · lines 69–129 · +53 −53

Medium · CVSS 4.8

EPSS 0.2%2026-01-16

WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarDescricao, nomeClasse=ProdutoControle)

CVE-2026-23729 · dao/DestinoDAO.php · lines 9–66 · +47 −64

Medium · CVSS 4.8

EPSS 0.2%2026-01-16

WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarDescricao, nomeClasse=ProdutoControle)

CVE-2026-23729 · dao/ProdutoDAO.php · lines 17–51 · +20 −67

Medium · CVSS 4.8

EPSS 0.2%2026-01-16

WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarDescricao, nomeClasse=ProdutoControle)

CVE-2026-23729 · dao/TipoEntradaDAO.php · lines 9–72 · +42 −46

Medium · CVSS 4.8

EPSS 0.2%2026-01-16

WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarDescricao, nomeClasse=ProdutoControle)

CVE-2026-23729 · dao/TipoSaidaDAO.php · lines 9–62 · +43 −58

Medium · CVSS 4.8

EPSS 0.2%2026-01-16

WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=DestinoControle)

CVE-2026-23728 · controle/Atendido_ocorrenciaControle.php · lines 69–129 · +53 −53

Medium · CVSS 4.8

EPSS 0.2%2026-01-16

WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=DestinoControle)

CVE-2026-23728 · dao/DestinoDAO.php · lines 9–66 · +47 −64

Medium · CVSS 4.8

EPSS 0.2%2026-01-16

WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=DestinoControle)

CVE-2026-23728 · dao/ProdutoDAO.php · lines 17–51 · +20 −67

Medium · CVSS 4.8

EPSS 0.2%2026-01-16

WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=DestinoControle)

CVE-2026-23728 · dao/TipoEntradaDAO.php · lines 9–72 · +42 −46

Medium · CVSS 4.8

EPSS 0.2%2026-01-16

WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=DestinoControle)

CVE-2026-23728 · dao/TipoSaidaDAO.php · lines 9–62 · +43 −58

Medium · CVSS 4.8

EPSS 0.2%2026-01-16

WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=TipoSaidaControle)

CVE-2026-23727 · controle/Atendido_ocorrenciaControle.php · lines 69–129 · +53 −53

Medium · CVSS 4.8

EPSS 0.2%2026-01-16

WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=TipoSaidaControle)

CVE-2026-23727 · dao/DestinoDAO.php · lines 9–66 · +47 −64

Medium · CVSS 4.8

EPSS 0.2%2026-01-16

WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=TipoSaidaControle)

CVE-2026-23727 · dao/ProdutoDAO.php · lines 17–51 · +20 −67

Medium · CVSS 4.8

EPSS 0.2%2026-01-16

WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=TipoSaidaControle)

CVE-2026-23727 · dao/TipoEntradaDAO.php · lines 9–72 · +42 −46

Medium · CVSS 4.8

EPSS 0.2%2026-01-16

WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=TipoSaidaControle)

CVE-2026-23727 · dao/TipoSaidaDAO.php · lines 9–62 · +43 −58

Medium · CVSS 4.8

EPSS 0.2%2026-01-16

WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=TipoEntradaControle)

CVE-2026-23726 · controle/Atendido_ocorrenciaControle.php · lines 69–129 · +53 −53

Medium · CVSS 4.8

EPSS 0.2%2026-01-16

WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=TipoEntradaControle)

CVE-2026-23726 · dao/DestinoDAO.php · lines 9–66 · +47 −64

Medium · CVSS 4.8

EPSS 0.2%2026-01-16

WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=TipoEntradaControle)

CVE-2026-23726 · dao/ProdutoDAO.php · lines 17–51 · +20 −67

Medium · CVSS 4.8

EPSS 0.2%2026-01-16

WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=TipoEntradaControle)

CVE-2026-23726 · dao/TipoEntradaDAO.php · lines 9–72 · +42 −46

Medium · CVSS 4.8

EPSS 0.2%2026-01-16

WeGIA has an Open Redirect Vulnerability in control.php Endpoint via nextPage Parameter (metodo=listarTodos, nomeClasse=TipoEntradaControle)

CVE-2026-23726 · dao/TipoSaidaDAO.php · lines 9–62 · +43 −58

Medium · CVSS 4.8

EPSS 0.2%2026-01-16

WeGIA Stored Cross-Site Scripting (XSS) – nome Parameter on Adopters Information Page

CVE-2026-23725 · controle/Atendido_ocorrenciaControle.php · lines 69–129 · +53 −53

Medium · CVSS 5.3

EPSS 0.2%2026-01-16

WeGIA Stored Cross-Site Scripting (XSS) – nome Parameter on Adopters Information Page

CVE-2026-23725 · dao/DestinoDAO.php · lines 9–66 · +47 −64

Medium · CVSS 5.3

EPSS 0.2%2026-01-16

WeGIA Stored Cross-Site Scripting (XSS) – nome Parameter on Adopters Information Page

CVE-2026-23725 · dao/ProdutoDAO.php · lines 17–51 · +20 −67

Medium · CVSS 5.3

EPSS 0.2%2026-01-16

WeGIA Stored Cross-Site Scripting (XSS) – nome Parameter on Adopters Information Page

CVE-2026-23725 · dao/TipoEntradaDAO.php · lines 9–72 · +42 −46

Medium · CVSS 5.3

EPSS 0.2%2026-01-16

WeGIA Stored Cross-Site Scripting (XSS) – nome Parameter on Adopters Information Page

CVE-2026-23725 · dao/TipoSaidaDAO.php · lines 9–62 · +43 −58

Medium · CVSS 5.3

EPSS 0.2%2026-01-16

WeGIA Stored Cross-Site Scripting (XSS) – atendido_idatendido Parameter on Occurrence Registration Page

CVE-2026-23724 · controle/Atendido_ocorrenciaControle.php · lines 69–129 · +53 −53

Medium · CVSS 5.4

EPSS 0.2%2026-01-16

WeGIA Stored Cross-Site Scripting (XSS) – atendido_idatendido Parameter on Occurrence Registration Page

CVE-2026-23724 · dao/DestinoDAO.php · lines 9–66 · +47 −64

Medium · CVSS 5.4

EPSS 0.2%2026-01-16

WeGIA Stored Cross-Site Scripting (XSS) – atendido_idatendido Parameter on Occurrence Registration Page

CVE-2026-23724 · dao/ProdutoDAO.php · lines 17–51 · +20 −67

Medium · CVSS 5.4

EPSS 0.2%2026-01-16

WeGIA Stored Cross-Site Scripting (XSS) – atendido_idatendido Parameter on Occurrence Registration Page

CVE-2026-23724 · dao/TipoEntradaDAO.php · lines 9–72 · +42 −46

Medium · CVSS 5.4

EPSS 0.2%2026-01-16

WeGIA Stored Cross-Site Scripting (XSS) – atendido_idatendido Parameter on Occurrence Registration Page

CVE-2026-23724 · dao/TipoSaidaDAO.php · lines 9–62 · +43 −58

Medium · CVSS 5.4

EPSS 0.2%2026-01-16

WeGIA has a Critical SQL Injection in Atendido_ocorrenciaControle via id_memorando parameter

CVE-2026-23723 · controle/Atendido_ocorrenciaControle.php · lines 69–129 · +53 −53

High · CVSS 7.2

EPSS 0.4%2026-01-16

WeGIA has a Critical SQL Injection in Atendido_ocorrenciaControle via id_memorando parameter

CVE-2026-23723 · dao/DestinoDAO.php · lines 9–66 · +47 −64

High · CVSS 7.2

EPSS 0.4%2026-01-16

WeGIA has a Critical SQL Injection in Atendido_ocorrenciaControle via id_memorando parameter

CVE-2026-23723 · dao/ProdutoDAO.php · lines 17–51 · +20 −67

High · CVSS 7.2

EPSS 0.4%2026-01-16

WeGIA has a Critical SQL Injection in Atendido_ocorrenciaControle via id_memorando parameter

CVE-2026-23723 · dao/TipoEntradaDAO.php · lines 9–72 · +42 −46

High · CVSS 7.2

EPSS 0.4%2026-01-16

WeGIA has a Critical SQL Injection in Atendido_ocorrenciaControle via id_memorando parameter

CVE-2026-23723 · dao/TipoSaidaDAO.php · lines 9–62 · +43 −58

High · CVSS 7.2

EPSS 0.4%2026-01-16

WeGIA SQL Injection via 'cpf' param at endpoint `/html/funcionario/cadastro_funcionario_pessoa_existente.php`

CVE-2025-62179 · dao/FuncionarioDAO.php · lines 158–159 · +2 −2

High · CVSS 8.6

EPSS 0.4%2025-10-13

WeGIA: Open Redirect Vulnerability in `control.php` endpoint

CVE-2025-61606 · controle/FuncionarioControle.php · line 676 · +1 −1

Medium · CVSS 4.8

EPSS 0.2%2025-10-02

WeGIA: Cross-Site Request Forgery (CSRF) Vulnerability in `control.php` Endpoint

CVE-2025-61604 · controle/AlmoxarifadoControle.php · lines 44–69 · +17 −12

High · CVSS 7.1

EPSS 0.2%2025-10-02

WeGIA: SQL Injection (Blind Time-Based) Vulnerability in API `descricao` Parameter

CVE-2025-61603 · controle/ProdutoControle.php · lines 110–123 · +6 −14

Critical · CVSS 9.4

EPSS 0.4%2025-10-02

WeGIA allows Stored XSS attacks in novo_memorando.php

CVE-2025-53526 · controle/memorando/MemorandoControle.php · lines 61–70 · +7 −11

Low · CVSS 2.0

EPSS 0.3%2025-07-07

WeGIA allows Stored XSS attacks in novo_memorando.php

CVE-2025-53526 · dao/memorando/MemorandoDAO.php · lines 144–167 · +19 −23

Low · CVSS 2.0

EPSS 0.3%2025-07-07

WeGIA Open Redirect vulnerability

CVE-2025-24020 · controle/FuncionarioControle.php · lines 711–754 · +13 −12 in 2 hunks

Medium · CVSS 4.8

EPSS 0.3%2025-01-21

Cross-Site Scripting (XSS) Stored endpoint 'control.php' parameter 'cargo' in WeGIA

CVE-2025-23037 · controle/CargoControle.php · lines 16–19 · +2 −2

Medium · CVSS 6.4

EPSS 0.3%2025-01-13

incluir

Overview

CVEs that patched it

Other functions in these files

Other hotspots in the repository

Frequently asked questions

References

Track LabRedesCefetRJ/WeGIA CVEs