WeGIA < 3.6.5 - Authenticated Remote Code Execution via Database Restore Filename
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2026-28409. PoCs published by exploitintel. A Nuclei detection template is also available.
AI-analyzed exploit summary The repository contains only an embargo notice for CVE-2026-28409, indicating a command injection bypass in WeGIA. No actual exploit code or technical details are provided, only a placeholder for future documentation.
Description
WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, a critical Remote Code Execution (RCE) vulnerability exists in the WeGIA application's database restoration functionality. An attacker with administrative access (which can be obtained via the previously reported Authentication Bypass) can execute arbitrary OS commands on the server by uploading a backup file with a specifically crafted filename. Version 3.6.5 fixes the issue.
Exploits (1)
The repository contains only an embargo notice for CVE-2026-28409, indicating a command injection bypass in WeGIA. No actual exploit code or technical details are provided, only a placeholder for future documentation.
Nuclei Templates (1)
http.html:"WeGIA"
body="WeGIA"
References (1)
Related Analysis
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
