CVE-2025-62360CWE-89sql-injection

CVE-2025-62360

High · published October 14, 2025

CVSS v3.1
8.8
EPSS
1%
Percentile
59.1
In the wild
Unconfirmed
What it is

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.Prior to 3.5.1, a SQL Injection vulnerability was identified in the /html/funcionario/dependente_documento.php endpoint, specifically in the id_dependente parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This vulnerability is fixed in 3.5.1.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00893 · 59.1th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-10-14T02:15Z
Affected products (1)
ProductVersionsFixed in
wegia/wegia< 3.5.13.5.1
References (4)
https://github.com/LabRedesCefetRJ/WeGIA/commit/7abbffd3915a64b97dde01954222fc0fbd804f70 · [email protected]https://github.com/LabRedesCefetRJ/WeGIA/issues/310 · [email protected]https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-m4j6-q5m4-x24g · [email protected]https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-mwvv-q9gh-gwxm · [email protected]
EPSS history
Timeline
  • 13 OCT 21:24Z
    WeGIA SQL Injection via 'id_dependente' param at endpoint `/html/funcionario/dependente_documento.php`
    cvelistv5