CVE-2025-30365 is a critical (CVSS 9.8) SQL injection in WeGIA, a web manager for charitable institutions. Before version 3.2.8, the query parameter of query_geracao_auto.php in the socio module allowed arbitrary SQL. Version 3.2.8 fixes it. Upgrade, and review the database and web logs for unusual query values.
What's affected
The record and the GitHub advisory list WeGIA versions before 3.2.8 as affected. WeGIA is a web manager for charitable institutions, and it is installed through Composer according to the advisory.
Version 3.2.8 contains the fix.
The record does not flag the CVE as known exploited, and the CVE is not in the CISA KEV catalog at the time of writing.
How to check if you're exposed
Find the version of WeGIA you run.
- Check the version shown in the application, or the release or tag you deployed from.
- For Composer based installs, run composer show on the package to see the version.
- Search your web server access logs for requests to the affected path and unusual parameter values, and check database logs for errors.
If you manage donor or beneficiary data in WeGIA, assume that the database is a target and check backups.
What to do now
- Upgrade WeGIA to 3.2.8 or later.
- Search logs for requests to the query_geracao_auto.php controller with unusual query values.
- Reduce the database account's permissions to the minimum needed.
- Restrict the application to trusted networks where possible.
- Review other WeGIA CVEs from March 2025 and confirm your version covers them all.
Why it matters
The record maps the flaw to CWE-89 (SQL Injection). The query parameter of a controller in the socio (member) module is passed into a database query without being kept separate from the SQL. The advisory states that this compromises the confidentiality, integrity and availability of the database.
The module deals with members and donations, so the stored data can include personal and financial details. The advisory fixes this in 3.2.8, together with CVE-2025-30364. A third SQL injection, CVE-2025-30367, was fixed earlier in 3.2.6.
SQL injection remains common because queries are easy to build by string concatenation. The long term fix is code level: parameterized queries everywhere, plus review of any endpoint that takes free form input.
If you run WeGIA for a charity, also confirm that backups are recent and kept away from the application server. A restore test is worth doing at the same time. Injection flaws can alter data as well as read it, and a clean backup is the fastest way back.
Quick check
Is this fixed together with CVE-2025-30364?
Both are fixed in 3.2.8 according to their advisories.
What data is at risk?
Whatever the database holds. For this module that may include member and donation records.
Sources
Last reviewed: 19 October 2026.
