CVE-2025-53937

CRITICAL

WeGIA < 3.4.5 - SQL Injection via controle/control.php cargo Parameter

Title source: llm
STIX 2.1

Description

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in the `/controle/control.php` endpoint, specifically in the `cargo` parameter, of WeGIA prior to version 3.4.5. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. Version 3.4.5 fixes the issue.

References (1)

Core 1
Core References

Scores

CVSS v3 9.8
EPSS 0.0018
EPSS Percentile 39.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-89
Status published
Products (1)
wegia/wegia < 3.4.5
Published Jul 16, 2025
Tracked Since Feb 18, 2026