In versions of WeGIA before 3.7.0 the file atendido/familiar_docfamiliar.php presents an overly verbose error message that contains database details. This excessive disclosure can reveal internal database structure and configuration, assisting an attacker in mapping the backend and expanding the attack surface. The flaw is identified as a classic information‑disclosure weakness under CWE‑200, affecting confidentiality rather than direct code execution or denial of service.

The vulnerability applies to all installations of the WeGIA web manager produced by LabRedesCefetRJ running any version earlier than 3.7.0. No finer version granularity is supplied beyond the major release cutoff.

The CVSS score of 6.9 points to a moderate severity issue. As the EPSS score is not available, the likelihood of exploitation is not quantified, and the vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation to date. The likely attack vector is a web request to the /atendido/familiar_docfamiliar.php endpoint, potentially executable without authentication, which would trigger the verbose error output. The disclosed database information aids further reconnaissance but it does not directly lead to code execution or system compromise.