CVE-2025-30367 - WeGIA SQL Injection Vulnerability in nextPage Parameter on control.php Endpoint

Back Back to CVE browser

CRITICAL

WeGIA SQL Injection Vulnerability in nextPage Parameter on control.php Endpoint

Published Mar 27, 2025

10.0

CRITICAL

CVSS 4.0

EPSS 0.51%

Description

WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.2.6 in the nextPage parameter of the /WeGIA/controle/control.php endpoint. This vulnerability allows attacker to manipulate SQL queries and access sensitive database information, such as table names and sensitive data. Version 3.2.6 contains a fix for the issue.

Affected products

Vendor LabRedesCefetRJ Product WeGIA Default
n/a
- Version
  < 3.2.6
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

LabRedesCefetRJ

WeGIA

n/a

Version	Status	Constraints
< 3.2.6	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-89

SQL Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-8517
Advisory
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-7j9v-xgmm-h7wr
exploitx_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-8517		Advisory
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-7j9v-xgmm-h7wr		exploitx_refsource_CONFIRMVendor Advisory