CVE-2025-61604 HIGH

CVE-2025-61604: WeGIA: Cross-Site Request Forgery (CSRF) Vulnerability in `control.php` Endpoint

Vendor Labredescefetrj

Product WeGIA

Weakness CWE-352 · CSRF

Published October 2, 2025

Last update October 2, 2025

View on NVD All CVEs

CVSS base score

7.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction —

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Cross-Site Request Forgery (CSRF) vulnerability. The delete operation for the Almoxarifado entity is exposed via HTTP GET without CSRF protection, allowing a third-party site to trigger the action using the victim’s authenticated session. This issue is fixed in version 3.5.0.

Key dates

02Disclosure timeline

October 2, 2025 CVE published

October 2, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-61604 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/352.html