PT-2025-40424 · Wegia · Wegia

Marcelomulder · Published 2025-10-02 · Updated 2025-10-07 · CVE-2025-61603

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WeGIA versions 3.4.12 and below

Description WeGIA is a Web manager for charitable institutions. A SQL Injection issue exists in the /controle/control.php endpoint, specifically in the descricao parameter. This allows attackers to execute arbitrary SQL commands, potentially compromising the confidentiality, integrity, and availability of the database.

Recommendations Update to version 3.5.0 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-61603

GHSA-V8HM-PQ8G-C7J4

Affected Products

Wegia

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61603.json · Exploit
• 🔥 https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-v8hm-pq8g-c7j4 · Exploit
• https://github.com/LabRedesCefetRJ/WeGIA/commit/84958eed73741a544859eea297908db3b83b3833 · Patch
• https://osv.dev/vulnerability/CVE-2025-61603 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61603 · Security Note
• https://t.me/cveNotify/137675 · Telegram Post
• https://twitter.com/CVEnew/status/1973844587589283952 · Twitter Post
• https://t.me/CVEtracker/33977 · Telegram Post
• https://twitter.com/offseq/status/1973901400372306360 · Twitter Post
• https://twitter.com/0dayPublishing/status/1973842669781528728 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1973921599255441746 · Twitter Post