CVE-2025-46828 is a critical unauthenticated SQL injection flaw (CVSS 9.8 in the record) in WeGIA, a web manager for charitable institutions, in versions up to 3.3.0. The vulnerable endpoint is get_socios.php, and no login is needed. Upgrade to version 3.3.1, which fixes the issue, and review your logs for odd requests.
What's affected
The NVD record says WeGIA versions up to and including 3.3.0 are affected, and version 3.3.1 fixes the issue. WeGIA is a web application for managing charitable institutions, so it may hold personal data about members and donors.
The flaw is in the endpoint /html/socio/sistema/get_socios.php. According to the advisory, the endpoint takes a value from a request and passes it directly to a database call without validation. The advisory states it may lead to data exfiltration, authentication bypass or complete database compromise.
How to check if you're exposed
Check the WeGIA version and exposure of the endpoint.
- Open the WeGIA administration area or the project files and read the installed version. Anything at or below 3.3.0 is affected.
- If you installed from git, run the command shown below in the application folder.
- Check whether the application is reachable from the internet and whether the endpoint path answers without a login.
- Search the web server logs for requests to get_socios.php, and review them for unusual values or an unexpected source.
- Check the database for unexpected accounts or changed records.
Commands referred to above, in order:
git describe --tags
What to do now
- Upgrade WeGIA to 3.3.1 or later, after taking a backup of the application and its database.
- If you cannot upgrade immediately, block access to get_socios.php at the web server or reverse proxy.
- Restrict the application to the networks that need it, such as the institution's own network or a VPN.
- Review database and web server logs for suspicious requests since the application was first exposed.
- Rotate database credentials and administrator passwords if the logs show suspicious requests.
- Tell the people responsible for data protection if personal data may have been read.
Why it matters
The record lists CWE-89 (SQL Injection). SQL injection happens when text from a request is placed into a database command without being kept separate from the command itself. The advisory shows code that took a request value and ran it as a query directly, which is the simplest form of the problem.
Because the endpoint needs no login, anyone who can reach the application can try it. Systems for charities often hold sensitive personal data and run on small budgets with infrequent updates, which makes a prompt upgrade important. The record does not mark this CVE as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
Static analysis of the source is a good way to catch this class of flaw before release, as the demo below shows.
Try it yourself
The demo shows how a static code scan flags unsafe database calls like this one before they ship.
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes it?
WeGIA 3.3.1, according to the advisory.
Does the attacker need to log in?
No. The record describes an unauthenticated flaw.
Sources
Last reviewed: 18 October 2026.
