WeGIA, a web manager for charitable institutions, hashes user passwords with PHP's hash() function using the SHA‑256 algorithm without a salt in html/login.php and in the password change flow. SHA‑256 is a general‑purpose hash that is fast but not designed for storing passwords; lacking a salt means identical passwords produce identical digests and the entire hash database can be broken with a single precomputed rainbow table or offline brute‑force attempt, allowing an attacker to discover blind user passwords and impersonate any account.

The affected vendor is LabRedesCefetRJ, product WeGIA. Versions earlier than 3.7.3 are vulnerable; version 3.7.3 and later contain a fix that replaces the weak hashing algorithm.

With a CVSS score of 5.9 the severity is medium, and the EPSS score is not publicly available, so the exploitation likelihood is uncertain but potentially significant when the hash database is exposed. The vulnerability is listed as not in CISA KEV. The likely attack vector is offline: an attacker who acquires or observes the stored SHA‑256 hashes can use precomputed tables or rapid brute‑force to recover plaintext passwords. If the attacker can also gain authenticated access, they could elevate privileges or steal institutional data, but the vulnerability itself does not provide remote code execution or continuous access.