CVE-2025-61604
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-02

Last updated on: 2025-10-07

Assigner: GitHub, Inc.

Description
WeGIA is an open source web manager with a focus on charitable institutions. Versions 3.4.12 and below contain a Cross-Site Request Forgery (CSRF) vulnerability. The delete operation for the Almoxarifado entity is exposed via HTTP GET without CSRF protection, allowing a third-party site to trigger the action using the victim’s authenticated session. This issue is fixed in version 3.5.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-02
Last Modified
2025-10-07
Generated
2026-06-16
AI Q&A
2025-10-02
EPSS Evaluated
2026-06-15
NVD
CVE-2025-61604
EUVD
EUVD-2025-33218
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
wegia wegia to 3.5.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) issue in WeGIA versions 3.4.12 and below. Specifically, the delete operation for the Almoxarifado entity can be triggered via an HTTP GET request without any CSRF protection. This means a malicious third-party website can cause a logged-in user to unknowingly perform the delete action using their authenticated session.

Impact Analysis

An attacker can exploit this vulnerability to delete Almoxarifado entities without the user's consent by tricking the user into visiting a malicious site. This could lead to unauthorized data deletion and potential disruption of operations within the affected web manager.

Mitigation Strategies

Upgrade WeGIA to version 3.5.0 or later, as this version fixes the CSRF vulnerability in the delete operation for the Almoxarifado entity. Until the upgrade can be performed, avoid accessing or allowing access to the vulnerable delete operation via HTTP GET requests, and consider implementing additional CSRF protections or restricting access to trusted users only.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-61604. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart