CVE-2025-61603

CriticalCVSS 9.8/10Last modified Oct 12, 2026

Description

WeGIA is a Web manager for charitable institutions. Versions 3.4.12 and below include an SQL Injection vulnerability which was identified in the /controle/control.php endpoint, specifically in the descricao parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This issue is fixed in version 3.5.0.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Oct 2, 2025
Last modified
Oct 12, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-616047.1WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Cross-Site Request Forgery CVE-2025-616059.8WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an SQL Injection vulnerabilitCVE-2025-616066.1WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an Open Redirect vulnerabilitCVE-2025-616077.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additionCVE-2025-616087.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additionCVE-2025-616097.5In modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional CVE-2025-61619.8A vulnerability, which was classified as critical, was found in SourceCodester Simple Food Ordering System 1.0. Affected is an unknown functCVE-2025-616107.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additionCVE-2025-616117.5In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privilegeCVE-2025-616127.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additionCVE-2025-616137.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additionCVE-2025-616147.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no addition
CVE-2025-61603: Critical severity, CVSS 9.8 | Vulnix