CVE-2025-61604
Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-10-02

Last updated on: 2025-10-07

Assigner: GitHub, Inc.

Description
WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Cross-Site Request Forgery (CSRF) vulnerability. The delete operation for the Almoxarifado entity is exposed via HTTP GET without CSRF protection, allowing a third-party site to trigger the action using the victim’s authenticated session. This issue is fixed in version 3.5.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2025-10-02
Last Modified
2025-10-07
Generated
2026-07-06
AI Q&A
2025-10-02
EPSS Evaluated
2026-07-05
NVD
CVE-2025-61604
EUVD
EUVD-2025-33218

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wegia wegia to 3.5.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) issue in WeGIA versions 3.4.12 and below. Specifically, the delete operation for the Almoxarifado entity can be triggered via an HTTP GET request without any CSRF protection. This means a malicious third-party website can cause a logged-in user to unknowingly perform the delete action using their authenticated session.

Impact Analysis

An attacker can exploit this vulnerability to delete Almoxarifado entities without the user's consent by tricking the user into visiting a malicious site. This could lead to unauthorized data deletion and potential disruption of operations within the affected web manager.

Mitigation Strategies

Upgrade WeGIA to version 3.5.0 or later, as this version fixes the CSRF vulnerability in the delete operation for the Almoxarifado entity. Until the upgrade can be performed, avoid accessing or allowing access to the vulnerable delete operation via HTTP GET requests, and consider implementing additional CSRF protections or restricting access to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-61604. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart