CVE-2025-54079 WeGIA vulnerable to SQL Injection (Blind Time-Based) in endpoint 'Profile_Atendido.php' parameter 'idatendido'

CriticalCVSS 9.4 EPSS 0.45%

Published: 2025-07-18 18:56
Updated: 2026-06-17 12:39
Exploit status: No public exploit known

Description

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.4.6 in the endpoint /html/atendido/Profile_Atendido.php, in the idatendido parameter. This vulnerability allow an authorized attacker to execute arbitrary SQL queries, allowing access to sensitive information. Version 3.4.6 fixes the issue.

Affected products

Product	Affected versions	Fixed in
LabRedesCefetRJ WeGIA	= < 3.4.6	No fix listed
wegia	< 3.4.6	3.4.6

References

https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-g4v3-j8w5-33v3 exploit vendor-advisory

CVSS v4.0

9.4 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: Low
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: High
Subsequent System Confidentiality: High
Subsequent System Integrity: High
Subsequent System Availability: High

All scores (3)

v4.0 9.4 · github_m
v4.0 9.4 · security-advisories@github.com
v3.1 8.8 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.45% (percentile 39.3)
CWE: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.