CVE-2025-61665
Last modified
CVE-2025-61665 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Broken Access Control vulnerability, identified in the get_relatorios_socios.php endpoint. EPSS estimates a 0.45% chance of exploitation in the next 30 days.
Description
WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Broken Access Control vulnerability, identified in the get_relatorios_socios.php endpoint. This vulnerability allows unauthenticated attackers to directly access sensitive personal and financial information of members without requiring authentication or authorization. This issue is fixed in version 3.5.0.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Wegia | Wegia | < 3.5.0 |
References
- https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-62wp-6qmh-6p5fExploit, Vendor Advisory
- https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-62wp-6qmh-6p5fExploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-61665?
How severe is CVE-2025-61665?
How do I fix CVE-2025-61665?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-61659bash-git-prompt 2.6.1 through 2.7.1 insecurely uses the /tmp…6.8
- CVE-2025-6166A vulnerability was found in frdel Agent-Zero up to 0.8.4. I…5.1
- CVE-2025-61661A vulnerability has been identified in the GRUB (Grand Unifi…4.8
- CVE-2025-61662A Use-After-Free vulnerability has been discovered in GRUB's…7.8
- CVE-2025-61663A vulnerability has been identified in the GRUB2 bootloader'…4.9
- CVE-2025-61664A vulnerability in the GRUB2 bootloader has been identified …4.9
- CVE-2025-61666Traccar is an open source GPS tracking system. Default insta…8.7
- CVE-2025-61667The Datadog Agent collects events and metrics from hosts and…7
- CVE-2025-61668Volto is a ReactJS-based frontend for the Plone Content Mana…8.7
- CVE-2025-61669Jupyter Server is the backend for Jupyter web applications. …6.1
- CVE-2025-6167A vulnerability classified as critical has been found in the…9.8
- CVE-2025-61670Wasmtime is a runtime for WebAssembly. Wasmtime 37.0.0 and 3…3.3
Are you affected by CVE-2025-61665?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST