Skip to content
OpenAdvisories
Critical · 9.4 CVE-2025-55167 EUVD-2025-24453

WeGIA SQL Injection via id_fichamedica at endpoint `GET/html/funcionario/dependente_remover.php`

Published Aug 12, 2025 · Updated Aug 12, 2025 · Assigned by GitHub_M

Description

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a SQL Injection vulnerability was identified in the /html/funcionario/dependente_remover.php endpoint, specifically in the id_dependente parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This issue has been patched in version 3.4.8.

Affected products

VendorProductAffectedFixed
LabRedesCefetRJ WeGIA < 3.4.8 —

References