CVE-2025-27140 describes an OS Command Injection vulnerability in WeGIA, a web manager for charitable institutions, specifically affecting versions prior to 3.2.15 via the importar_dump.php endpoint. This critical vulnerability (CVSS 9.8) allows unauthenticated remote attackers to execute arbitrary code and potentially upload webshells, leading to full compromise of the affected system. While the vulnerability is severe, there is currently no evidence of active exploitation, public exploit code, or significant community discussion, indicating a low immediate threat despite its high potential impact.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 3.2.15CPE matchmatch criteria | cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:* |
CVSS version used by this source: 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.