CVE-2025-30364 is a critical (CVSS 9.8) SQL injection in WeGIA, a web manager for charitable institutions. Before version 3.2.8, the id_funcionario parameter of /WeGIA/html/funcionario/remuneracao.php allowed arbitrary SQL commands. Version 3.2.8 fixes it. Upgrade, and review database and web logs for odd values in that parameter.
What's affected
The record and the GitHub advisory list WeGIA versions before 3.2.8 as affected. WeGIA is a web manager for charitable institutions, and it is installed through Composer according to the advisory.
Version 3.2.8 contains the fix.
The record does not flag the CVE as known exploited, and the CVE is not in the CISA KEV catalog at the time of writing.
How to check if you're exposed
Find the version of WeGIA you run.
- Check the version shown in the application, or the release or tag you deployed from.
- For Composer based installs, run composer show on the package to see the version.
- Search your web server access logs for requests to the affected path and unusual parameter values, and check database logs for errors.
If you manage donor or beneficiary data in WeGIA, assume that the database is a target and check backups.
What to do now
- Upgrade WeGIA to 3.2.8 or later.
- Review web and database logs for odd values in the id_funcionario parameter.
- Check that the database account used by WeGIA has only the permissions it needs.
- Restrict the application to trusted networks if possible, and add web application firewall rules for SQL metacharacters.
- Back up the database before and after the upgrade, and test the restore.
Why it matters
The record maps the flaw to CWE-89 (SQL Injection). The employee identifier parameter is used in a database query without being kept apart from the query text, so crafted input can change what the query does. The advisory says this compromises confidentiality, integrity and availability of the stored data.
This is one of several SQL injection issues reported in WeGIA, including CVE-2025-30365 and CVE-2025-30367. Together they point to a pattern, and the right response is to upgrade to the newest version rather than patch one flaw at a time.
The page in question deals with employee remuneration data, which is sensitive. Parameterized queries are the standard defense, and a web application scan can help find similar patterns in your own code.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this the only SQL injection in WeGIA?
No. CVE-2025-30365 and CVE-2025-30367 are also SQL injection issues in WeGIA, fixed in 3.2.8 and 3.2.6 respectively.
How do I test for this safely?
Use a test copy of the application and a scanner you control. Never test against systems you do not own.
Sources
Last reviewed: 19 October 2026.
