CVE-2025-26617

Published Feb 18, 2025

Last updated 3 days ago

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-26617 is a SQL injection vulnerability found in the WeGIA web application, an open-source web manager for institutions. Specifically, the vulnerability exists in the `historico_paciente.php` endpoint. Successful exploitation allows attackers to execute arbitrary SQL queries. This could lead to unauthorized access to sensitive data managed by the application. The vulnerability has been addressed in WeGIA version 3.2.14. Users are strongly encouraged to update to this version to mitigate the risk.

Description: WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A SQL Injection vulnerability was discovered in the WeGIA application, `historico_paciente.php` endpoint. This vulnerability could allow an attacker to execute arbitrary SQL queries, allowing unauthorized access to sensitive information. This issue has been addressed in version 3.2.14 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Source: security-advisories@github.com
NVD status: Received

Risk scores

CVSS 4.0

Type: Secondary
Base score: 10
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: CRITICAL

Weaknesses

security-advisories@github.com: CWE-89

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 3

Overview

AI description

Risk scores

CVSS 4.0

Weaknesses

Social media

References