Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

WeGIA vulnerable to SQL Injection (Blind Time-Based) in remuneracao.php parameter id_funcionario

CVE-2025-30364 · published 1 year ago
Summary

WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.2.8 in the endpoint /WeGIA/html/funcionario/remuneracao.php, in the id_funcionario parameter. This vulnerability allows the execution of arbitrary SQL commands, which can compromis...

What to do
  • Update wegia wegia to version 3.2.8 or later.
Affected software
VendorProductAffected versions
wegia wegia < 3.2.8
cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:*
Original advisory text
WeGIA vulnerable to SQL Injection (Blind Time-Based) in remuneracao.php parameter id_funcionario
WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.2.8 in the endpoint /WeGIA/html/funcionario/remuneracao.php, in the id_funcionario parameter. This vulnerability allows the execution of arbitrary SQL commands, which can compromise the confidentiality, integrity, and availability of stored data. Version 3.2.8 fixes the issue.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.9 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published27 Mar 2025
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2025-30364 · NVD
CVE-2025-30364 · OSV
GHSA-x3ff-5qp7-43qv · GHSA
Track software like this
Free during beta