PT-2025-7791

CVE-2025-27140

Published

2025-02-24

Updated

2025-03-03

Description by

CVSS 4.0

Critical

MetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.2.15

Description WeGIA is a Web manager for charitable institutions. An OS Command Injection issue was discovered, allowing an attacker to execute arbitrary code remotely via the importar dump.php endpoint. This could also enable a webshell upload.

Recommendations For versions prior to 3.2.15, update to version 3.2.15 to apply the patch for the issue. As a temporary workaround, consider restricting access to the importar dump.php endpoint until the update can be applied.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-78: Improper Neutralization of Special Elements used in an OS Command (\'OS Command Injection\')

CWE-284: Improper Access Control

Related identifiers

CVE-2025-27140