What’s Vulnerable › Vulnerabilities

CVE-2025-62360: WeGIA SQL Injection via 'id_dependente' param at endpoint `/html/funcionario/dependente_documento.php`

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-10-13 · updated 2026-10-08
• Weakness: CWE-89

Description

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.Prior to 3.5.1, a SQL Injection vulnerability was identified in the /html/funcionario/dependente_documento.php endpoint, specifically in the id_dependente parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This vulnerability is fixed in 3.5.1.

Affected products

• LabRedesCefetRJ WeGIA: before 3.5.1 — fixed in 3.5.1

How to fix

Upgrade to a fixed version: LabRedesCefetRJ WeGIA 3.5.1. Check the vendor advisory for mitigations.

References

• https://github.com/LabRedesCefetRJ/WeGIA/commit/7abbffd3915a64b97dde01954222fc0fbd804f70
• https://github.com/LabRedesCefetRJ/WeGIA/issues/310
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-m4j6-q5m4-x24g
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-mwvv-q9gh-gwxm

Get alerted when CVE-2025-62360 or the next vulnerability affects your stack