CVE-2025-27140

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

WeGIA is a Web manager for charitable institutions. An OS Command Injection vulnerability was discovered in versions prior to 3.2.15 of the WeGIA application, `importar_dump.php` endpoint. This vulnerability could allow an attacker to execute arbitrary code remotely. The command is basically a command to move a temporary file, so a webshell upload is also possible. Version 3.2.15 contains a patch for the issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78 CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Feb 24, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-271416.5Metabase Enterprise Edition is the enterprise version of Metabase business intelligence and data analytics software. Starting in version 1.4 CVE-2025-271428.8LocalSend is a free, open-source app that allows users to securely share files and messages with nearby devices over their local network wit CVE-2025-271436.1Better Auth is an authentication and authorization library for TypeScript. Prior to version 1.1.21, the application is vulnerable to an open CVE-2025-271446.6Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web En CVE-2025-271456.1copyparty, a portable file server, has a DOM-based cross-site scripting vulnerability in versions prior to 1.16.15. The vulnerability is con CVE-2025-271464.3matrix-appservice-irc is a Node.js IRC bridge for Matrix. The matrix-appservice-irc bridge up to version 3.0.3 contains a vulnerability whic CVE-2025-271478.2The GLPI Inventory Plugin handles various types of tasks for GLPI agents, including network discovery and inventory (SNMP), software deploym CVE-2025-271488.8Gradle is a build automation tool, and its native-platform tool provides Java bindings for native APIs. On Unix-like systems, the system tem CVE-2025-271492.7Zulip server provides an open-source team chat that helps teams stay productive and focused. Prior to 10.0, the data export to organization CVE-2025-27153.5A vulnerability classified as problematic has been found in timschofield webERP up to 5.0.0.rc+13. This affects an unknown part of the file CVE-2025-271506.5Tuleap is an Open Source Suite to improve management of software developments and collaboration. The password to connect the Redis instance CVE-2025-271519.8Redis is an open source, in-memory database that persists on disk. In versions starting from 7.0.0 to before 8.0.2, a stack-based buffer ove