Skip to content
OpenAdvisories
Critical · 9.4 CVE-2025-53937 EUVD-2025-21717

WeGIA has SQL Injection (Blind Time-Based) Vulnerability in `cargo` Parameter on `control.php` Endpoint

Published Jul 16, 2025 · Updated Jul 18, 2025 · Assigned by GitHub_M

Description

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in the `/controle/control.php` endpoint, specifically in the `cargo` parameter, of WeGIA prior to version 3.4.5. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. Version 3.4.5 fixes the issue.

Affected products

VendorProductAffectedFixed
LabRedesCefetRJ WeGIA < 3.4.5 —

References