CVE-2025-26610: SQL Injection endpoint 'restaurar_produto_desocultar.php' parameter 'id_produto' in WeGIA
First published: Tue Feb 18 2025(Updated: )
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, `restaurar_produto_desocultar.php` endpoint. This vulnerability allow an authorized attacker to execute arbitrary SQL queries, allowing access to sensitive information. This issue has been addressed in version 3.2.13 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Wegia Wegia | <3.2.13 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2025-26610?
CVE-2025-26610 has a medium severity due to its potential for SQL injection exploitation by authorized attackers.
How do I fix CVE-2025-26610?
To fix CVE-2025-26610, update WeGIA to version 3.2.14 or later, which addresses the SQL injection vulnerability.
What versions of WeGIA are affected by CVE-2025-26610?
CVE-2025-26610 affects WeGIA versions prior to 3.2.13.
Can CVE-2025-26610 be exploited by unauthorized users?
No, CVE-2025-26610 requires an authorized user to exploit the SQL injection vulnerability.
What impacts does CVE-2025-26610 pose to my application?
CVE-2025-26610 can allow attackers to execute arbitrary SQL commands, potentially leading to data leakage or manipulation.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/severity
- agent/author
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/wegia
- canonical/wegia wegia