CVE-2025-67501: WeGIA is vulnerable to SQL Injection via editar_categoria endpoint parameter
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Versions 3.5.4 and below contain an SQL Injection vulnerability in the /html/matPat/editarcategoria.php endpoint. The application fails to properly validate and sanitize user inputs in the idcategoria parameter, which allows attackers to inject malicious SQL payloads for direct execution. This issue is fixed in version 3.5.5.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-67501?
CVE-2025-67501 is classified as a high severity vulnerability due to the potential for SQL injection attacks.
How do I fix CVE-2025-67501?
To fix CVE-2025-67501, upgrade WeGIA to version 3.5.5 or later, which includes patches for the vulnerability.
What is the impact of CVE-2025-67501 on users?
The impact of CVE-2025-67501 allows attackers to manipulate SQL queries, potentially leading to unauthorized access to the database.
Which versions of WeGIA are affected by CVE-2025-67501?
WeGIA versions 3.5.4 and below are affected by CVE-2025-67501.
Where can I find more information about CVE-2025-67501?
More information about CVE-2025-67501 can typically be found in security advisories and release notes from WeGIA.