CVE-2025-26612: SQL Injection endpoint 'adicionar_almoxarife.php' parameter 'id_almoxarifado', 'id_funcionario' in WeGIA
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, adicionaralmoxarife.php endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing unauthorized access to sensitive information. This issue has been addressed in version 3.2.13 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIAto a version that resolves this vulnerability.Fixed in 3.2.13
Event History
Frequently Asked Questions
What is the severity of CVE-2025-26612?
CVE-2025-26612 has a high severity rating due to its potential to allow an attacker to execute arbitrary SQL queries.
How do I fix CVE-2025-26612?
To fix CVE-2025-26612, update WeGIA to version 3.2.14 or later, where the vulnerability has been addressed.
What are the potential impacts of CVE-2025-26612?
The potential impacts of CVE-2025-26612 include unauthorized database access, data manipulation, and possible data leakage.
Which versions of WeGIA are affected by CVE-2025-26612?
Versions of WeGIA prior to 3.2.14 are affected by CVE-2025-26612.
How is CVE-2025-26612 exploited?
CVE-2025-26612 can be exploited by passing malicious SQL code through the 'adicionar_almoxarife.php' endpoint in WeGIA.