CVE-2025-50201

WeGIA is a web manager for charitable institutions. Prior to version 3.4.2, an OS Command Injection vulnerability was identified in the /html/configuracao/debug_info.php endpoint. The branch parameter is not properly sanitized before being concatenated and executed in a shell command on the server's operating system. This flaw allows an unauthenticated attacker to execute arbitrary commands on the server with the privileges of the web server user (www-data). This issue has been patched in version 3.4.2.

• CWE-78

• https://github.com/LabRedesCefetRJ/WeGIA/commit/45f32ad1d52775fc99f3c90075c8136c6d4d1d3dPatch
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-52p5-5fmw-9hrfExploit, Vendor Advisory

Published

Jun 19, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-50196Chamilo is a learning management system. Prior to version 1.…7.2
• CVE-2025-50197Chamilo is a learning management system. Prior to version 1.…7.2
• CVE-2025-50198Chamilo is a learning management system. Prior to version 1.…4.9
• CVE-2025-50199Chamilo is a learning management system. Prior to version 1.…9.1
• CVE-2025-5020Opening maliciously-crafted URLs in Firefox from other apps …4.3
• CVE-2025-50200RabbitMQ is a messaging and streaming broker. In versions 3.…5.5
• CVE-2025-50202Lychee is a free photo-management tool. In versions starting…7.5
• CVE-2025-50213Failure to Sanitize Special Elements into a Different Plane …9.8
• CVE-2025-5022Weak Password Requirements vulnerability in Mitsubishi Elect…6.5
• CVE-2025-50228Jizhicms v2.5.4 is vulnerable to Server-Side Request Forgery…9.1
• CVE-2025-50229Jizhicms v2.5.4 is vulnerable to SQL injection in the produc…9.8
• CVE-2025-5023Use of Hard-coded Credentials vulnerability in Mitsubishi El…7.1