CVE-2025-58159

WeGIA is a Web manager for charitable institutions. Prior to version 3.4.11, a remote code execution vulnerability was identified, caused by improper validation of uploaded files. The application allows an attacker to upload files with arbitrary filenames, including those with a .php extension. Because the uploaded file is written directly to disk without adequate sanitization or extension restrictions, a spreadsheet file followed by PHP code can be uploaded and executed on the server, leading to arbitrary code execution. This is due to insufficient mitigation of CVE-2025-22133. This issue has been patched in version 3.4.11.

• CWE-94
• CWE-434
• CWE-434

• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-wj2c-237g-cgqpExploit, Vendor Advisory

Published

Aug 29, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-58151varstored is a component of the Xapi toolstack handling UEFI…9.4
• CVE-2025-58152FutureNet MA and IP-K series provided by Century Systems Co.…6.9
• CVE-2025-58153Under undisclosed traffic conditions along with conditions b…5.9
• CVE-2025-58156Centurion ERP is an ERP with a focus on ITSM and automation.…4.3
• CVE-2025-58157gnark is a zero-knowledge proof system framework. In version…7.5
• CVE-2025-58158Harness Open Source is an end-to-end developer platform with…8.8
• CVE-2025-5816The Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kar…4.3
• CVE-2025-58160tracing is a framework for instrumenting Rust programs to co…2.3
• CVE-2025-58161MobSF is a mobile application security testing tool used. In…4.3
• CVE-2025-58162MobSF is a mobile application security testing tool used. In…6.5
• CVE-2025-58163FreeScout is a free help desk and shared inbox built with PH…8.8
• CVE-2025-58164Rejected reason: This CVE is a duplicate of another CVE, CVE…