CVE-2025-61665CWE-200CWE-287information-disclosure

CVE-2025-61665

High · published October 3, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
40.1
In the wild
Unconfirmed
What it is

WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Broken Access Control vulnerability, identified in the get_relatorios_socios.php endpoint. This vulnerability allows unauthenticated attackers to directly access sensitive personal and financial information of members without requiring authentication or authorization. This issue is fixed in version 3.5.0.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00475 · 40.1th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-287 · Improper Authentication
Published
2025-10-03T01:16Z
Affected products (1)
ProductVersionsFixed in
wegia/wegia< 3.5.03.5.0
References (3)
https://github.com/LabRedesCefetRJ/WeGIA/commit/828f23a6a760a52b8bb8bfd583cc2b23c42da51e · [email protected]https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-62wp-6qmh-6p5f · [email protected]https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-62wp-6qmh-6p5f · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 02 OCT 20:39Z
    WeGIA: Broken Access Control in `get_relatorios_socios.php` Endpoint
    cvelistv5