CVE-2025-61604

HighCVSS 7.1/10Last modified Oct 12, 2026

Description

WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Cross-Site Request Forgery (CSRF) vulnerability. The delete operation for the Almoxarifado entity is exposed via HTTP GET without CSRF protection, allowing a third-party site to trigger the action using the victim’s authenticated session. This issue is fixed in version 3.5.0.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Weakness enumeration

CWE-352

Affected software

VendorProductVersions
LabRedesCefetRJWeGIA< 3.5.0

References

Timeline

Published
Oct 2, 2025
Last modified
Oct 12, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-616059.8WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an SQL Injection vulnerabilitCVE-2025-616066.1WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain an Open Redirect vulnerabilitCVE-2025-616077.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additionCVE-2025-616087.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additionCVE-2025-616097.5In modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional CVE-2025-61619.8A vulnerability, which was classified as critical, was found in SourceCodester Simple Food Ordering System 1.0. Affected is an unknown functCVE-2025-616107.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additionCVE-2025-616117.5In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privilegeCVE-2025-616127.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additionCVE-2025-616137.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additionCVE-2025-616147.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additionCVE-2025-616157.5In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no addition
CVE-2025-61604: High severity, CVSS 7.1 | Vulnix