PT-2025-13381 · Wegia · Wegia

Nmmorette

·

Published

2025-03-27

·

Updated

2025-04-19

·

CVE-2025-30361

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.2.6
Description A security issue was identified in WeGIA, a Web manager for charitable institutions, where it is possible to change a user's password without verifying the old password. This issue exists in the "control.php" endpoint and allows unauthorized attackers to bypass authentication and authorization mechanisms to reset the password of any user, including admin accounts.
Recommendations For versions prior to 3.2.6, update to version 3.2.6 to resolve the issue. As a temporary workaround, consider restricting access to the "control.php" endpoint until the update is applied.

Exploit

Fix

Improper Authentication

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2025-30361
GHSA-M6QW-R3M9-JF7H

Affected Products

Wegia