SQL Injection Vulnerability in WeGIA Web Manager by LabRedesCefetRJ
CVE-2025-54060

9.4CRITICAL

Key Information:

Vendor

Labredescefetrj

Status
Wegia
Vendor
CVE Published:
17 July 2025

What is CVE-2025-54060?

A significant SQL Injection vulnerability has been identified in WeGIA, an open-source web management platform tailored for Portuguese-speaking charitable institutions. The flaw resides in the idatendido_familiares parameter of the /html/funcionario/dependente_editarInfoPessoal.php endpoint, allowing attackers to craft malicious SQL queries. This could lead to unauthorized access to sensitive database information, including revealing table structures and confidential user data. The issue has been addressed in version 3.4.6, ensuring enhanced security for users.

Affected Version(s)

WeGIA < 3.4.6

References

https://github.com/LabRedesCefetRJ/WeGIA/security/advisor...
x_refsource_CONFIRM

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-54060 : SQL Injection Vulnerability in WeGIA Web Manager by LabRedesCefetRJ