CVE-2025-55167: Critical SQL Injection in WeGIA

CVE-2025-55167 is a critical SQL injection in WeGIA, an open source web manager built for charitable institutions. The id_dependente parameter of /html/funcionario/dependente_remover.php reaches a database query without proper handling in versions before 3.4.8. The fix is version 3.4.8. No login is needed.

What's affected

• Product: WeGIA, an open source web manager focused on the Portuguese language and charitable institutions.
• Affected: versions before 3.4.8.
• Fixed: 3.4.8.
• Endpoint: /html/funcionario/dependente_remover.php, parameter id_dependente.
• Impact per the advisory: execution of arbitrary SQL commands, affecting the confidentiality, integrity and availability of the database.
• Authentication: the CVSS vector shows no privileges required.

A sibling finding, CVE-2025-55168, affects a different endpoint and was fixed in the same release.

How to check if you're exposed

Check the WeGIA version in your installation. If you deployed from the project's repository, look at the tag or commit.

git describe --tags 2>/dev/null
git log -1 --format="%H %cd"

Anything below 3.4.8 is affected. WeGIA holds data about people served by charities, such as beneficiaries and staff, so also check how the application is exposed. Look at the web server logs for requests to the endpoint above with unusual values, and at database logs for odd queries.

Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that checks a manifest or lockfile against known vulnerabilities, and the Gold directory lists affected packages for each CVE.

What to do now

1. Upgrade WeGIA to 3.4.8 or later, and test the affected screens afterwards.
2. Back up the database before and after the upgrade.
3. If you cannot upgrade at once, restrict access to the application to trusted networks, or block the affected endpoint at the web server.
4. Review database and web logs for signs of misuse, and check your obligations to notify people if personal data may have been read.
5. Give the application's database account only the privileges it needs.

Why it matters

SQL injection happens when user input is built into a query instead of being passed as a parameter. A numeric looking identifier is a classic place for it, because developers assume the value is safe. The record scores it 9.8 since no login is needed.

The data matters more than the score. Charitable organizations hold records about vulnerable people, often with health information, and often have small IT teams. Patching quickly and keeping the application off the open internet are the two most useful controls. Parameterized queries throughout the code base are the lasting fix. The CVE is not on the CISA KEV list.

The weakness is classed as CWE-89 (SQL Injection). Severity in the CVE record: critical, CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Try it yourself

Static analysis can flag string built queries like this one before they ship. This demo shows the idea.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• GitHub advisory GHSA-4fqm-ww3v-6mwv
• Fix commit (listed in the CVE record, not fetched)

Last reviewed: 18 October 2026.