Skip to content
OpenAdvisories
High · 8.6 CVE-2025-62177 EUVD-2025-34109

WeGIA vulnerable to SQL Injection via 'id_funcionario' param at endpoint `/html/funcionario/dependente_listar.php`

Published Oct 13, 2025 · Updated Oct 14, 2025 · Assigned by GitHub_M

Description

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.1, a SQL Injection vulnerability was identified in the /html/funcionario/dependente_listar.php endpoint, specifically in the id_funcionario parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This vulnerability is fixed in 3.5.1.

Affected products

VendorProductAffectedFixed
LabRedesCefetRJ WeGIA < 3.5.1 —

References