PT-2025-29866 · Wegia · Wegia

Marcelomulder · Published 2025-07-11 · Updated 2025-07-25 · CVE-2025-53937

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.4.5

Description WeGIA is an open-source web manager designed for Portuguese-language and charitable institutions. A SQL Injection issue exists in the /controle/control.php API endpoint, specifically through the cargo parameter. This allows attackers to execute arbitrary SQL commands, potentially compromising the database's confidentiality, integrity, and availability.

Recommendations Update to WeGIA version 3.4.5 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2025-09271

CVE-2025-53937

GHSA-J3QV-V3M7-73PJ

Affected Products

Wegia

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53937.json · Exploit
• 🔥 https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-j3qv-v3m7-73pj · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-53937 · Security Note
• https://bdu.fstec.ru/vul/2025-09271 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53937 · Vendor Advisory
• https://t.me/cvetracker/27982 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1945573947333873694 · Twitter Post
• https://twitter.com/CVEnew/status/1945562946739859695 · Twitter Post
• https://twitter.com/dailycve/status/1948821743130595529 · Twitter Post