What’s Vulnerable › Vulnerabilities

CVE-2025-53938: WeGIA vulnerable to Authentication Bypass due to Missing Session Validation in multiple endpoints

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-07-16 · updated 2026-06-17
• Weakness: CWE-306

Description

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. An Authentication Bypass vulnerability was identified in the `/dao/verificar_recursos_cargo.php` endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows unauthenticated users to access protected application functionalities and retrieve sensitive information by sending crafted HTTP requests without any session cookies or authentication tokens. Version 3.4.5 fixes the issue.

Affected products

• LabRedesCefetRJ WeGIA: before 3.4.5 — fixed in 3.4.5

How to fix

Upgrade to a fixed version: LabRedesCefetRJ WeGIA 3.4.5. Check the vendor advisory for mitigations.

References

• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-6p76-7mm4-j5rj
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-6p76-7mm4-j5rj

Get alerted when CVE-2025-53938 or the next vulnerability affects your stack