Vulnerability details

CVE-2025-55167

LabRedesCefetRJ WeGIA

WeGIA SQL Injection via id_fichamedica at endpoint `GET/html/funcionario/dependente_remover.php`

CVSS 4.0

9.4Critical

Official description

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a SQL Injection vulnerability was identified in the /html/funcionario/dependente_remover.php endpoint, specifically in the id_dependente parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This issue has been patched in version 3.4.8.

CVSS scores

Score	Version	Source	Vector
9.4Critical	4.0	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`

Affected products

Vendor	Product	Versions	Source
LabRedesCefetRJ	WeGIA	< 3.4.8	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-4fqm-ww3v-6mwv x_refsource_CONFIRM
https://github.com/LabRedesCefetRJ/WeGIA/commit/cb7f5e2b98ef6087b80659627f368612e3c535f3 x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-08-12
Last updated: 2025-08-12
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.56%

Probability of exploitation in 30 days

47.3%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: Proof of concept
Technical impact: Total

Weaknesses (CWE)

CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')