PT-2025-40428 · Wegia · Wegia

Marcelomulder · Published 2025-10-02 · Updated 2025-10-07 · CVE-2025-61665

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions WeGIA versions 3.4.12 and below

Description WeGIA, a web manager for charitable institutions, has a Broken Access Control issue. The get relatorios socios.php API endpoint allows unauthenticated attackers to directly access sensitive personal and financial information of members without authentication or authorization.

Recommendations Update to version 3.5.0 or later.

Exploit

Fix

Improper Authentication

Information Disclosure

Weakness Enumeration

CWE-287

CWE-200

Related Identifiers

CVE-2025-61665

GHSA-62WP-6QMH-6P5F

Affected Products

Wegia

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61665.json · Exploit
• 🔥 https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-62wp-6qmh-6p5f · Exploit
• https://github.com/LabRedesCefetRJ/WeGIA/commit/828f23a6a760a52b8bb8bfd583cc2b23c42da51e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-61665 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61665 · Vendor Advisory
• https://t.me/CVEtracker/33983 · Telegram Post
• https://t.me/cveNotify/137679 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1973906240980897928 · Twitter Post
• https://twitter.com/CVEnew/status/1973853092375368056 · Twitter Post