CVE-2025-62360 CRITICAL

CVE-2025-62360: WeGIA SQL Injection via 'id_dependente' param at endpoint `/html/funcionario/dependente_documento.php`

Vendor Labredescefetrj

Product WeGIA

Weakness CWE-89 · SQLi

Published October 13, 2025

Last update October 14, 2025

View on NVD All CVEs

CVSS base score

9.4/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

What the vulnerability does

01Description

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.Prior to 3.5.1, a SQL Injection vulnerability was identified in the /html/funcionario/dependente_documento.php endpoint, specifically in the id_dependente parameter. This vulnerability allows attackers to execute arbitrary SQL commands, compromising the confidentiality, integrity, and availability of the database. This vulnerability is fixed in 3.5.1.

Key dates

02Disclosure timeline

October 13, 2025 CVE published

October 14, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-62360 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/89.html

Related vulnerabilities

CVE-2025-62360: WeGIA SQL Injection via 'id_dependente' param at endpoint `/html/funcionario/dependente_documento.php`

01Description

02Disclosure timeline

03References

04Related CVE