PT-2025-29867 · Wegia · Wegia

Marcelomulder · Published 2025-07-11 · Updated 2025-07-25 · CVE-2025-53938

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.4.5

Description An authentication bypass issue exists in the /dao/verificar recursos cargo.php API endpoint of the WeGIA application. This allows unauthenticated users to access protected functionalities and retrieve sensitive information by sending crafted HTTP requests without valid session cookies or authentication tokens.

Recommendations Update to version 3.4.5 or later.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2025-09274

CVE-2025-53938

GHSA-6P76-7MM4-J5RJ

Affected Products

Wegia

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53938.json · Exploit
• 🔥 https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-6p76-7mm4-j5rj · Exploit
• https://osv.dev/vulnerability/CVE-2025-53938 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09274 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-53938 · Security Note
• https://twitter.com/dailycve/status/1948822150028185704 · Twitter Post
• https://t.me/cvetracker/27983 · Telegram Post
• https://twitter.com/CVEnew/status/1945562945628377314 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1945576507243479510 · Twitter Post