CVE-2025-53938CWE-306

WeGIA vulnerable to Authentication Bypass due to Missing Session Validation in multiple endpoints

Medium · published July 16, 2025

CVSS v4.0
6.9
EPSS
1%
Percentile
54.0
In the wild
Unconfirmed
What it is

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. An Authentication Bypass vulnerability was identified in the `/dao/verificar_recursos_cargo.php` endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows unauthenticated users to access protected application functionalities and retrieve sensitive information by sending crafted HTTP requests without any session cookies or authentication tokens. Version 3.4.5 fixes the issue.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00736 · 54.0th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2025-07-16T16:04Z
EPSS history
Timeline
  • 16 JUL 16:04Z
    WeGIA vulnerable to Authentication Bypass due to Missing Session Validation in multiple endpoints
    cvelistv5