PT-2025-50293 · Wegia · Wegia

L0Gs3C · Published 2025-12-09 · Updated 2025-12-10 · CVE-2025-67501

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions WeGIA versions 3.5.4 and below

Description WeGIA is a web manager for institutions, primarily for Portuguese language users. The application does not properly validate and sanitize user inputs in the id categoria parameter of the /html/matPat/editar categoria.php endpoint, allowing attackers to inject malicious SQL payloads for direct execution. This could lead to complete system compromise, requiring administrative privileges for exploitation.

Recommendations Update to version 3.5.5 or later.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-67501

GHSA-HJ2X-QFM3-2869

Affected Products

Wegia

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67501.json · Exploit
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-hj2x-qfm3-2869 · Vendor Advisory
• https://github.com/LabRedesCefetRJ/WeGIA/commit/f04b91f584a38c2061a071b26219dba3f25819e6 · Patch
• https://osv.dev/vulnerability/CVE-2025-67501 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67501 · Security Note
• https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.5.5 · Note
• https://twitter.com/VulmonFeeds/status/1998664129997864992 · Twitter Post
• https://twitter.com/0dayPublishing/status/1998542126947180889 · Twitter Post
• https://t.me/CVEtracker/39323 · Telegram Post
• https://twitter.com/CVEnew/status/1998732759418941709 · Twitter Post