CVE-2025-24906

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_detalhes_cobranca.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Feb 3, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-249076.8Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not prop CVE-2025-249086.8Overview The product uses external input to construct a pathname that should be within a restricted directory, but it does not prop CVE-2025-249094.4Overview The software does not neutralize or incorrectly neutralize user-controllable input before it is placed in output that is u CVE-2025-24915.4A vulnerability classified as problematic has been found in Dromara ujcms 9.7.5. This affects the function update of the file /main/java/com CVE-2025-249104.9Overview XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of CVE-2025-249114.9Overview XML documents optionally contain a Document Type Definition (DTD), which, among other features, enables the definition of CVE-2025-249123.7hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker i CVE-2025-249147.8When installing Nessus to a non-default location on a Windows host, Nessus versions prior to 10.8.4 did not enforce secure permissions for s CVE-2025-249157.8When installing Nessus Agent to a non-default location on a Windows host, Nessus Agent versions prior to 10.8.3 did not enforce secure permi CVE-2025-249167.8When installing Tenable Network Monitor to a non-default location on a Windows host, Tenable Network Monitor versions prior to 6.5.1 did not CVE-2025-249177.8In Tenable Network Monitor versions prior to 6.5.1 on a Windows host, it was found that a non-administrative user could stage files in a loc CVE-2025-249186.7Improper link resolution before file access ('link following') for some Intel(R) Server Configuration Utility software and Intel(R) Server F