What is the severity of CVE-2025-24906?

CVE-2025-24906 is considered a high severity SQL Injection vulnerability that can lead to unauthorized access or deletion of sensitive data.

How do I fix CVE-2025-24906?

To fix CVE-2025-24906, update WeGIA to version 3.2.12 or later, which addresses the SQL Injection vulnerability.

What are the risks of CVE-2025-24906 in WeGIA?

The risks of CVE-2025-24906 include potential unauthorized access to sensitive information and the ability to manipulate or delete data.

Is CVE-2025-24906 present in earlier versions of WeGIA?

Yes, CVE-2025-24906 is present in all versions of WeGIA prior to 3.2.12.

Vulnerability/
CVE-2025-24906

critical

CWE

EPSS

0.106%

3/2/2025

13/2/2025

CVE-2025-24906: SQL Injection endpoint 'get_detalhes_cobranca.php' parameter 'codigo' in WeGIA

Q: What kind of attack can be executed through CVE-2025-24906?

CVE-2025-24906 allows an authorized attacker to execute arbitrary SQL queries against the WeGIA application.

First published: Mon Feb 03 2025(Updated: )

WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_detalhes_cobranca.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Credit: security-advisories@github.com

Affected Software	Affected Version	How to fix
Wegia Wegia	<3.2.12
Wegia Wegia	<3.2.12

Never miss a vulnerability like this again

Reference Links

https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-jpph-g9p7-9jrm

Frequently Asked Questions

What is the severity of CVE-2025-24906?
CVE-2025-24906 is considered a high severity SQL Injection vulnerability that can lead to unauthorized access or deletion of sensitive data.
How do I fix CVE-2025-24906?
To fix CVE-2025-24906, update WeGIA to version 3.2.12 or later, which addresses the SQL Injection vulnerability.
What kind of attack can be executed through CVE-2025-24906?
CVE-2025-24906 allows an authorized attacker to execute arbitrary SQL queries against the WeGIA application.
What are the risks of CVE-2025-24906 in WeGIA?
The risks of CVE-2025-24906 include potential unauthorized access to sensitive information and the ability to manipulate or delete data.
Is CVE-2025-24906 present in earlier versions of WeGIA?
Yes, CVE-2025-24906 is present in all versions of WeGIA prior to 3.2.12.

agent/weakness
agent/references
agent/author
agent/type
agent/description
collector/mitre-cve
source/MITRE
agent/title
agent/source
agent/first-publish-date
agent/tags
collector/epss-latest
source/FIRST
collector/nvd-api
source/NVD
agent/last-modified-date
agent/severity
agent/softwarecombine
agent/epss
agent/event
agent/guess-ai
agent/software-canonical-lookup
agent/software-canonical-lookup-request
vendor/wegia
canonical/wegia wegia

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.