The flaw resides in the deletar_tag.php script of the WeGIA web manager. The code extracts request parameters directly and then concatenates the id_tag value into SQL statements without any sanitization or prepared statements, constituting a classic insecure direct injection vulnerability (CWE‑89). An attacker who can send crafted HTTP requests to this endpoint could modify the SELECT, UPDATE, or DELETE queries to read, alter, or delete arbitrary records, potentially exposing confidential information or compromising the integrity of the system.

LabRedesCefetRJ WeGIA versions earlier than 3.6.7 are affected. The vulnerability exists in all releases prior to this patch, including 3.6.6 and older. Only the 3.6.7 release and subsequent builds contain the fix that removes the insecure code path.

The CVSS score of 8.8 signals high severity, and the EPSS score of less than 1% indicates that exploitation is currently uncommon in the wild. The flaw is not listed in the CISA KEV catalog. The likely attack vector is via HTTP requests to the deletar_tag.php endpoint, where manipulating the id_tag parameter can achieve the injection. If the application lacks robust authentication or access controls, the risk escalates to unauthenticated exploitation, allowing a wide attack surface.