CVE-2025-26612: SQL Injection endpoint 'adicionar_almoxarife.php' parameter 'id_almoxarifado', 'id_funcionario' in WeGIA
First published: Tue Feb 18 2025(Updated: )
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, `adicionar_almoxarife.php` endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing unauthorized access to sensitive information. This issue has been addressed in version 3.2.13 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Wegia Wegia | <3.2.13 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2025-26612?
CVE-2025-26612 has a high severity rating due to its potential to allow an attacker to execute arbitrary SQL queries.
How do I fix CVE-2025-26612?
To fix CVE-2025-26612, update WeGIA to version 3.2.14 or later, where the vulnerability has been addressed.
What are the potential impacts of CVE-2025-26612?
The potential impacts of CVE-2025-26612 include unauthorized database access, data manipulation, and possible data leakage.
Which versions of WeGIA are affected by CVE-2025-26612?
Versions of WeGIA prior to 3.2.14 are affected by CVE-2025-26612.
How is CVE-2025-26612 exploited?
CVE-2025-26612 can be exploited by passing malicious SQL code through the 'adicionar_almoxarife.php' endpoint in WeGIA.
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/severity
- agent/author
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/wegia
- canonical/wegia wegia