CVE-2025-53091 is a critical unauthenticated SQL injection flaw (CVSS 9.8) in WeGIA, the open source web manager for charitable institutions. Version 3.3.3 is affected through the almox parameter of one endpoint. Version 3.4.0 fixes it, so upgrade and check your database for unexpected access.
What's affected
The GitHub advisory GHSA-pmf9-2rc3-vvxx lists the Composer package WeGIA, affected version 3.3.3, and patched version 3.4.0. The advisory rates it Critical.
It names the endpoint /controle/getProdutosPorAlmox.php and the almox parameter. It describes a time based blind SQL injection, meaning the attacker infers data from how long the response takes. The advisory says no cookies, tokens or headers are needed, so any unauthenticated visitor who can reach the endpoint can use it. The weakness is CWE-89.
The impact listed by the advisory includes access to sensitive data such as users, passwords and logs, enumeration of the database, and, depending on the database setup, escalation toward code execution.
How to check if you're exposed
Find your WeGIA installation and read the version. If you deployed from a Git checkout, this shows the tag:
git describe --tags
Otherwise check the release notes or the version shown in the application. Version 3.3.3 is named in the advisory. If you run an earlier version, do not assume it is safe, since the advisory only names 3.3.3 and the fix arrived in 3.4.0. Plan to upgrade.
Check whether the application is open to the internet. Then search web server logs for requests to the product lookup endpoint with unusual parameter values or with long response times.
What to do now
- Upgrade WeGIA to 3.4.0 or later. Note that a related issue, CVE-2025-53527, is fixed in 3.4.1, so aim for 3.4.1 or later.
- Back up the database and files before you upgrade, and test your customisations.
- Restrict access to the application with a VPN or an allow list if it does not need to face the internet.
- Review logs for abnormal requests to the product lookup endpoint, and check the database for access you cannot explain.
- Rotate stored credentials, including administrator passwords, if you find signs of abuse.
Why it matters
SQL injection is the case where user input is used to build a database query without being kept apart from the query itself. The advisory shows the time based form: the response delay confirms that injected SQL ran, and an attacker can use many such requests to read data one fact at a time. It is slow but works against pages that show no database output.
WeGIA is used by charitable institutions, which hold personal data about donors, beneficiaries and staff. The record does not mention use in attacks, and the CVE is not on the CISA Known Exploited Vulnerabilities list. The lack of authentication is what makes the score critical, so upgrade and limit exposure.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this need a login?
No. The advisory says the endpoint can be reached with no cookies, tokens or headers.
Sources
Last reviewed: 18 October 2026.
