CVE-2025-22133

WeGIA is a web manager for charitable institutions. Prior to 3.2.8, a critical vulnerability was identified in the /WeGIA/html/socio/sistema/controller/controla_xlsx.php endpoint. The endpoint accepts file uploads without proper validation, allowing the upload of malicious files, such as .phar, which can then be executed by the server. This vulnerability is fixed in 3.2.8.

• CWE-94
• CWE-434

• https://github.com/nilsonLazarin/WeGIA/commit/a08f04de96d3caec85496d7a89a5b82d1960d9ddPatch
• https://github.com/nilsonLazarin/WeGIA/security/advisories/GHSA-mjgr-2jxv-v8qfExploit, Third Party Advisory
• https://github.com/nilsonLazarin/WeGIA/security/advisories/GHSA-mjgr-2jxv-v8qfExploit, Third Party Advisory

Published

Jan 7, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-22128In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-22129Tuleap is an Open Source Suite to improve management of soft…4.3
• CVE-2025-2213A vulnerability was found in Castlenet CBW383G2N up to 20250…4.8
• CVE-2025-22130Soft Serve is a self-hostable Git server for the command lin…8.8
• CVE-2025-22131PhpSpreadsheet is a PHP library for reading and writing spre…6.1
• CVE-2025-22132WeGIA is a web manager for charitable institutions. A Cross-…4.8
• CVE-2025-22134When switching to other buffers using the :all command and v…5.5
• CVE-2025-22136Tabby (formerly Terminus) is a highly configurable terminal …8.6
• CVE-2025-22137Pingvin Share is a self-hosted file sharing platform and an …9.8
• CVE-2025-22138@codidact/qpixel is a Q&A-based community knowledge-sharing …5.1
• CVE-2025-22139WeGIA is a web manager for charitable institutions. A Reflec…6.1
• CVE-2025-2214A vulnerability was found in Microweber 2.0.19. It has been …6.1