by Kastro
Paper/Archive/CVE-2025-27096

CVE-2025-27096

LabRedesCefetRJ WeGIA — SQL Injection endpoint 'html/personalizacao_upload.php' parameter 'id_campo' in WeGIA

EPSS 0.6%public exploitCVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 47.5.475 × 209.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

WeGIA is a Web Manager for Institutions with a focus on Portuguese language. A SQL Injection vulnerability was discovered in the WeGIA application, personalizacao_upload.php endpoint. This vulnerability allow an authorized attacker to execute arbitrary SQL queries, allowing access to sensitive information. This issue has been addressed in version 3.2.14 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected

ProductAffectedFixed inSource
WeGIA< 3.2.14–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)9.4CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-j856-wh9m-9vpm