CVE-2025-53938

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-53938

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

W

eGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. An Authentication Bypass vulnerability was identified in the `/dao/verificar_recursos_cargo.php` endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows unauthenticated users to access protected application functionalities and retrieve sensitive information by sending crafted HTTP requests without any session cookies or authentication tokens. Version 3.4.5 fixes the issue.

References
Link Resource
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-6p76-7mm4-j5rj Exploit Vendor Advisory
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-6p76-7mm4-j5rj Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:*
History

25 Jul 2025, 16:37

Type Values Removed Values Added
First Time Wegia
Wegia wegia
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
References () https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-6p76-7mm4-j5rj - () https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-6p76-7mm4-j5rj - Exploit, Vendor Advisory
CPE cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:*

18 Jul 2025, 15:15

Type Values Removed Values Added
References () https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-6p76-7mm4-j5rj - () https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-6p76-7mm4-j5rj -

17 Jul 2025, 21:15

Type Values Removed Values Added
Summary
  • (es) WeGIA es un gestor web de código abierto centrado en el idioma portugués y las instituciones benéficas. Se identificó una vulnerabilidad de omisión de autenticación en el endpoint `/dao/verificar_recursos_cargo.php` de la aplicación WeGIA antes de la versión 3.4.5. Esta vulnerabilidad permite a usuarios no autenticados acceder a funcionalidades protegidas de la aplicación y recuperar información confidencial mediante el envío de solicitudes HTTP manipuladas sin cookies de sesión ni tokens de autenticación. La versión 3.4.5 corrige el problema.

16 Jul 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-16 16:15

Updated : 2025-07-25 16:37

NVD link : CVE-2025-53938

Mitre link : CVE-2025-53938

CVE.ORG link : CVE-2025-53938

JSON object : View

Products Affected

wegia

CWE
CWE-306

Missing Authentication for Critical Function