PT-2025-39699 · Wegia · Wegia

Gabrielpintosouza · Published 2025-09-27 · Updated 2025-10-02 · CVE-2025-59939

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.5.0

Description WeGIA, a Web manager for charitable institutions, contains a SQL Injection flaw. The issue affects the control.php endpoint, specifically through the id produto parameter. Exploitation can occur via malicious commands injected into the id produto parameter. The issue was addressed in version 3.5.0 through the implementation of prepared statements, sanitization, and validation of the id produto parameter.

Recommendations Update to version 3.5.0 or later. Apply prepared statements methods to the id produto parameter. Implement sanitization and validation on the id produto parameter.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-59939

GHSA-JX9M-PGF8-V489

Affected Products

Wegia

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59939.json · Exploit
• 🔥 https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-jx9m-pgf8-v489 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-59939 · Security Note
• https://osv.dev/vulnerability/CVE-2025-59939 · Vendor Advisory
• https://twitter.com/offseq/status/1971862945207366087 · Twitter Post
• https://twitter.com/cracbot/status/1973704555062788438 · Twitter Post
• https://t.me/CVEtracker/33514 · Telegram Post
• https://t.me/cveNotify/136673 · Telegram Post
• https://twitter.com/CveFindCom/status/1971744004740989365 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1971773258044256577 · Twitter Post