SQL Injection Flaw in WeGIA Web Manager for Charitable Institutions
CVE-2025-53529

9.8CRITICAL

Key Information:

Vendor

Labredescefetrj

Status
Wegia
Vendor
CVE Published:
7 July 2025

What is CVE-2025-53529?

An SQL Injection vulnerability exists in the WeGIA Web Manager, specifically in the /html/funcionario/profile_funcionario.php endpoint. The unprotected id_funcionario parameter allows attackers to execute arbitrary SQL commands, potentially compromising data integrity and security on the affected system. This flaw can be exploited by unauthenticated individuals, making it critical for users to update to version 3.4.3 or later, where this issue has been addressed.

Affected Version(s)

WeGIA < 3.4.3

References

https://github.com/LabRedesCefetRJ/WeGIA/security/advisor...
x_refsource_CONFIRM
https://github.com/LabRedesCefetRJ/WeGIA/commit/0a061bcc5...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-53529 : SQL Injection Flaw in WeGIA Web Manager for Charitable Institutions