CVE-2025-53091 CRITICAL

CVE-2025-53091: WeGIA has Unauthenticated Time-Based Blind SQL Injection in almox Parameter

Vendor Labredescefetrj
Product WeGIA
Weakness CWE-89 · SQLi
Published June 27, 2025
Last update June 27, 2025
View on NVD All CVEs

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

What the vulnerability does

01Description

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in version 3.3.3 the almox parameter of the `/controle/getProdutosPorAlmox.php` endpoint. This issue allows any unauthenticated attacker to inject arbitrary SQL queries, potentially leading to unauthorized data access or further exploitation depending on database configuration. Version 3.4.0 fixes the issue.

Key dates

02Disclosure timeline

June 27, 2025 CVE published
June 27, 2025 Record updated