Vulnerability · Published Mar 27, 2025 · Assigned by GitHub_M

CVE-2025-30361WeGIA Vulnerable to Broken Authentication - Old Password Validation

Critical 9.3

In plain English

A critical-severity improper authentication in WeGIA from LabRedesCefetRJ. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)0.6%top 53.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

WeGIA is a Web manager for charitable institutions. A security vulnerability was identified in versions prior to 3.2.6, where it is possible to change a user's password without verifying the old password. This issue exists in the control.php endpoint and allows unauthorized attackers to bypass authentication and authorization mechanisms to reset the password of any user, including admin accounts. Version 3.2.6 fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
LabRedesCefetRJ	WeGIA	< 3.2.6

Weakness: CWE-287 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:L/SI:H/SA:L

References

https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-m6qw-r3m9-jf7h x_refsource_CONFIRM