CVE-2025-24957

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_detalhes_socio.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published: Feb 3, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-249588.8WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `salvar_tag.php` CVE-2025-249591.0zx is a tool for writing better scripts. An attacker with control over environment variable values can inject unintended environment variabl CVE-2025-249608.7Jellystat is a free and open source Statistics App for Jellyfin. In affected versions Jellystat is directly using a user input in the route(CVE-2025-249616.0org.gaul S3Proxy implements the S3 API and proxies requests. Users of the filesystem and filesystem-nio2 storage backends could unintentiona CVE-2025-249628.8reNgine is an automated reconnaissance framework for web applications. In affected versions a user can inject commands via the nmap_cmd para CVE-2025-249637.5Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on th CVE-2025-249648.8Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious w CVE-2025-249658.5crun is an open source OCI Container Runtime fully written in C. In affected versions A malicious container image could trick the krun handl CVE-2025-249665.4reNgine is an automated reconnaissance framework for web applications. HTML Injection occurs when an application improperly validates or san CVE-2025-249675.4reNgine is an automated reconnaissance framework for web applications. A stored cross-site scripting (XSS) vulnerability exists in the admin CVE-2025-249688.8reNgine is an automated reconnaissance framework for web applications. An unrestricted project deletion vulnerability allows attackers with CVE-2025-249695.0iTop is an web based IT Service Management tool. Prior to version 3.2.1, a portal user can see any other contacts picture by changing the pi