CVE-2025-59939CWE-89sql-injection

CVE-2025-59939

High · published September 27, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
30.9
In the wild
Unconfirmed
What it is

WeGIA is a Web manager for charitable institutions. Prior to version 3.5.0, WeGIA is vulnerable to SQL Injection attacks in the control.php endpoint with the following parameters: nomeClasse=ProdutoControle&metodo=excluir&id_produto=[malicious command]. It is necessary to apply prepared statements methods, sanitization, and validations on theid_produto parameter. This issue has been patched in version 3.5.0.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00381 · 30.9th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-09-27T05:15Z
Affected products (1)
ProductVersionsFixed in
wegia/wegia< 3.5.03.5.0
References (1)
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-jx9m-pgf8-v489 · [email protected]
EPSS history
Timeline
  • 27 SEP 00:38Z
    WeGIA vulnerable to SQL Injection into method `excluir` of the `ProdutoControle` class in the parameter `id_produto`.
    cvelistv5