deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-57097
Published: 2025-02-03
Description: ClassCMS 4.8 is vulnerable to Cross Site Scripting (XSS) in class/admin/channel.php.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://github.com/ClassCMS/ClassCMS/issues/5; https://github.com/ClassCMS/ClassCMS/issues/5
CVE: CVE-2024-57098
Published: 2025-02-03
Description: Moss v0.1.3 version has an SQL injection vulnerability that allows attackers to inject carefully designed payloads into the order parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/deep-project/moss/issues/13
CVE: CVE-2024-57099
Published: 2025-02-03
Description: ClassCMS v4.8 has a code execution vulnerability. Attackers can exploit this vulnerability by constructing a payload in the classview parameter of the model management feature, allowing them to execute arbitrary code and potentially take control of the server.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94
References: https://github.com/ClassCMS/ClassCMS/issues/6
CVE: CVE-2024-57450
Published: 2025-02-03
Description: ChestnutCMS <=1.5.0 is vulnerable to File Upload via the Create template function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-434
References: https://locrian-lightning-dc7.notion.site/File-Upload-1628e5e2b1a2806a99b8faf140bd5e42
CVE: CVE-2024-57452
Published: 2025-02-03
Description: ChestnutCMS <=1.5.0 has an arbitrary file deletion vulnerability in contentcore.controller.FileController, which allows attackers to delete any file and folder.
CVSS Score: 7.5 (HIGH)
CWE: CWE-552
References: https://locrian-lightning-dc7.notion.site/File-Delete-1628e5e2b1a280cfb497de7b8bcff128; https://locrian-lightning-dc7.notion.site/File-Delete-1628e5e2b1a280cfb497de7b8bcff128
CVE: CVE-2024-57498
Published: 2025-02-03
Description: Cross Site Scripting vulnerability in sayski ForestBlog 20241223 allows a remote attacker to escalate privileges via the article editing function.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://gist.github.com/Catherines77/ac0b554f3d755879eb12bfd69ef585b1; https://github.com/saysky/ForestBlog/issues/102; https://github.com/saysky/ForestBlog/issues/102
CVE: CVE-2024-57669
Published: 2025-02-03
Description: Directory Traversal vulnerability in Zrlog backup-sql-file.jar v.3.0.31 allows a remote attacker to obtain sensitive information via the BackupController.java file.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://github.com/94fzb/zrlog-plugin-backup-sql-file/commit/32bdb36e6cc4f0b72e1ba85ef4458fb980946ea4; https://github.com/94fzb/zrlog/issues/193; https://github.com/HypeDuke/vulnerable-research/blob/main/CVE-2024-57669
CVE: CVE-2024-57968
Published: 2025-02-03
Description: Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible during web browsing by other users). upload.aspx can be used for this.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-434, CWE-434
References: https://advantive.my.site.com/support/s/article/VeraCore-Release-Notes-2024-4-2-1; https://intezer.com/blog/research/xe-group-exploiting-zero-days/; https://www.solissecurity.com/en-us/insights/xe-group-from-credit-card-skimming-to-exploiting-zero-days/
CVE: CVE-2025-22978
Published: 2025-02-03
Description: eladmin <=2.7 is vulnerable to CSV Injection in the exception log download module.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-74
References: https://github.com/elunez/eladmin/commit/d6a16e9afc0a3b96a56f1a24ed167e1beec6ce2f; https://github.com/elunez/eladmin/issues/863
CVE: CVE-2025-25064
Published: 2025-02-03
Description: SQL injection vulnerability in the ZimbraSync Service SOAP endpoint in Zimbra Collaboration 10.0.x before 10.0.12 and 10.1.x before 10.1.4 due to insufficient sanitization of a user-supplied parameter. Authenticated attackers can exploit this vulnerability by manipulating a specific parameter in the request, allowing them to inject arbitrary SQL queries that could retrieve email metadata.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.12#Security_Fixes; https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.4#Security_Fixes; https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories
CVE: CVE-2025-25065
Published: 2025-02-03
Description: SSRF vulnerability in the RSS feed parser in Zimbra Collaboration 9.0.0 before Patch 43, 10.0.x before 10.0.12, and 10.1.x before 10.1.4 allows unauthorized redirection to internal network endpoints.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-918
References: https://wiki.zimbra.com/wiki/Zimbra_Releases/10.0.12#Security_Fixes; https://wiki.zimbra.com/wiki/Zimbra_Releases/10.1.4#Security_Fixes; https://wiki.zimbra.com/wiki/Zimbra_Releases/9.0.0/P43#Security_Fixes
CVE: CVE-2025-25181
Published: 2025-02-03
Description: A SQL injection vulnerability in timeoutWarning.asp in Advantive VeraCore through 2025.1.0 allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter.
CVSS Score: 5.8 (MEDIUM)
CWE: CWE-89, CWE-89
References: https://advantive.my.site.com/support/s/knowledge; https://intezer.com/blog/research/xe-group-exploiting-zero-days/; https://www.solissecurity.com/en-us/insights/xe-group-from-credit-card-skimming-to-exploiting-zero-days/
CVE: CVE-2023-52163
Published: 2025-02-03
Description: Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 8.8 (HIGH)
CWE: CWE-862
References: https://www.akamai.com/blog/security-research/digiever-fix-that-iot-thing; https://www.txone.com/blog/digiever-fixes-sorely-needed/; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-52163
CVE: CVE-2023-52164
Published: 2025-02-03
Description: access_device.cgi on Digiever DS-2105 Pro 3.1.0.71-11 devices allows arbitrary file read. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-284
References: https://www.akamai.com/blog/security-research/digiever-fix-that-iot-thing; https://www.txone.com/blog/digiever-fixes-sorely-needed/
CVE: CVE-2024-34896
Published: 2025-02-03
Description: An issue in Nedis SmartLife Video Doorbell (WIFICDP10GY), Nedis SmartLife IOS v1.4.0 causes users who are disconnected from a previous peer-to-peer connection with the device to still have access to live video feed.
CVSS Score: 7.5 (HIGH)
References: http://nedis.com; https://urn.kb.se/resolve?urn=urn:nbn:se:kth:diva-359419
CVE: CVE-2024-34897
Published: 2025-02-03
Description: Nedis SmartLife android app v1.4.0 was discovered to contain an API key disclosure vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://nedis.com; https://urn.kb.se/resolve?urn=urn:nbn:se:kth:diva-359419
CVE: CVE-2024-44449
Published: 2025-02-03
Description: Cross Site Scripting vulnerability in Quorum onQ OS v.6.0.0.5.2064 allows a remote attacker to obtain sensitive information via the msg parameter in the Login page.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://quorum.com/about/; https://seclists.org/fulldisclosure/2025/Jan/23; http://seclists.org/fulldisclosure/2025/Jan/23
CVE: CVE-2024-56898
Published: 2025-02-03
Description: Broken access control vulnerability in Geovision GV-ASWeb with version v6.1.0.0 or less. This vulnerability allows low privilege users perform actions that they aren't authorized to, which can be leveraged to escalate privileges, create, modify or delete accounts.
CVSS Score: 8.8 (HIGH)
CWE: CWE-284
References: https://github.com/DRAGOWN/CVE-2024-56898
CVE: CVE-2024-56901
Published: 2025-02-03
Description: A Cross-Site Request Forgery (CSRF) vulnerability in Geovision GV-ASWeb application with the version 6.1.1.0 or less that allows attackers to arbitrarily create Administrator accounts via a crafted GET request method. This vulnerability is used in chain with CVE-2024-56903 for a successful CSRF attack.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://github.com/DRAGOWN/CVE-2024-56901
CVE: CVE-2024-56902
Published: 2025-02-03
Description: Information disclosure vulnerability in Geovision GV-ASManager web application with the version v6.1.0.0 or less, which discloses account information, including cleartext password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/DRAGOWN/CVE-2024-56902
CVE: CVE-2024-56903
Published: 2025-02-03
Description: Geovision GV-ASWeb with the version 6.1.1.0 or less allows attackers to modify POST request method with the GET against critical functionalities, such as account management. This vulnerability is used in chain with CVE-2024-56901 for a successful CSRF attack.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://github.com/DRAGOWN/CVE-2024-56903
CVE: CVE-2024-57451
Published: 2025-02-03
Description: ChestnutCMS <=1.5.0 has a directory traversal vulnerability in contentcore.controller.FileController#getFileList, which allows attackers to view any directory.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22
References: https://locrian-lightning-dc7.notion.site/Directory-traversal-1628e5e2b1a280fdb463c2235acc7f75
CVE: CVE-2025-22918
Published: 2025-02-03
Description: Polycom RealPresence Group 500 <=20 has Insecure Permissions due to automatically loaded cookies. This allows for the use of administrator functions, resulting in the leakage of sensitive user information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/MinggongKs/Polycom/blob/main/README.md
CVE: CVE-2025-24370
Published: 2025-02-03
Description: Django-Unicorn adds modern reactive component functionality to Django templates. Affected versions of Django-Unicorn are vulnerable to python class pollution vulnerability. The vulnerability arises from the core functionality `set_property_value`, which can be remotely triggered by users by crafting appropriate component requests and feeding in values of second and third parameter to the vulnerable function, leading to arbitrary changes to the python runtime status. With this finding at least five ways of vulnerability exploitation have been observed, stably resulting in Cross-Site Scripting (XSS), Denial of Service (DoS), and Authentication Bypass attacks in almost every Django-Unicorn-based application. This issue has been addressed in version 0.62.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE: CWE-915
References: https://github.com/adamghill/django-unicorn/commit/17614200f27174f789d4af54cc3a1f2b0df7870c; https://github.com/adamghill/django-unicorn/security/advisories/GHSA-g9wf-5777-gq43
CVE: CVE-2025-24899
Published: 2025-02-03
Description: reNgine is an automated reconnaissance framework for web applications. A vulnerability was discovered in reNgine, where **an insider attacker with any role** (such as Auditor, Penetration Tester, or Sys Admin) **can extract sensitive information from other reNgine users.** After running a scan and obtaining vulnerabilities from a target, the attacker can retrieve details such as `username`, `password`, `email`, `role`, `first name`, `last name`, `status`, and `activity information` by making a GET request to `/api/listVulnerability/`. This issue has been addressed in version 2.2.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://github.com/yogeshojha/rengine/commit/a658b8519f1a3347634b04733cf91ed933af1f99; https://github.com/yogeshojha/rengine/security/advisories/GHSA-r3fp-xr9f-wv38
CVE: CVE-2025-24959
Published: 2025-02-03
Description: zx is a tool for writing better scripts. An attacker with control over environment variable values can inject unintended environment variables into `process.env`. This can lead to arbitrary command execution or unexpected behavior in applications that rely on environment variables for security-sensitive operations. Applications that process untrusted input and pass it through `dotenv.stringify` are particularly vulnerable. This issue has been patched in version 8.3.2. Users should immediately upgrade to this version to mitigate the vulnerability. If upgrading is not feasible, users can mitigate the vulnerability by sanitizing user-controlled environment variable values before passing them to `dotenv.stringify`. Specifically, avoid using `"`, `'`, and backticks in values, or enforce strict validation of environment variables before usage.
CWE: CWE-94
References: https://github.com/google/zx/pull/1094; https://github.com/google/zx/security/advisories/GHSA-qwp8-x4ff-5h87
CVE: CVE-2025-24960
Published: 2025-02-03
Description: Jellystat is a free and open source Statistics App for Jellyfin. In affected versions Jellystat is directly using a user input in the route(s). This can lead to Path Traversal Vulnerabilities. Since this functionality is only for admin(s), there is very little scope for abuse. However, the `DELETE` `files/:filename` can be used to delete any file. This issue has been addressed in version 1.1.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.7 (HIGH)
CWE: CWE-22
References: https://cwe.mitre.org/data/definitions/22.html; https://github.com/CyferShepard/Jellystat/pull/303; https://github.com/CyferShepard/Jellystat/security/advisories/GHSA-6x46-6w9f-ffv6
CVE: CVE-2025-24961
Published: 2025-02-03
Description: org.gaul S3Proxy implements the S3 API and proxies requests. Users of the filesystem and filesystem-nio2 storage backends could unintentionally expose local files to users. This issue has been addressed in version 2.6.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE: CWE-22
References: https://github.com/apache/jclouds/commit/b0819e0ef5e08c792a4d1724b938714ce9503aa3; https://github.com/gaul/s3proxy/commit/86b6ee4749aa163a78e7898efc063617ed171980; https://github.com/gaul/s3proxy/security/advisories/GHSA-2ccp-vqmv-4r4x
CVE: CVE-2025-24962
Published: 2025-02-03
Description: reNgine is an automated reconnaissance framework for web applications. In affected versions a user can inject commands via the nmap_cmd parameters. This issue has been addressed in commit `c28e5c8d` and is expected in the next versioned release. Users are advised to filter user input and monitor the project for a new release.
CVSS Score: 8.8 (HIGH)
CWE: CWE-74
References: https://github.com/yogeshojha/rengine/commit/c28e5c8d304478a787811580b4d80b330920ace4; https://github.com/yogeshojha/rengine/security/advisories/GHSA-cg75-ph7x-5rr9
CVE: CVE-2024-35177
Published: 2025-02-03
Description: Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtualized, containerized, and cloud-based environments. The wazuh-agent for Windows is vulnerable to a Local Privilege Escalation vulnerability due to improper ACL of the non-default installation directory. A local malicious user could potentially exploit this vulnerability by placing one of the many DLL that are loaded and not present on the system in the installation folder of the agent OR by replacing the service executable binary itself with a malicious one. The root cause is an improper ACL applied on the installation folder when a non-default installation path is specified (e.g,: C:\wazuh). Many DLLs are loaded from the installation folder and by creating a malicious DLLs that exports the functions of a legit one (and that is not found on the system where the agent is installed, such as rsync.dll) it is possible to escalate privileges from a low-privileged user and obtain code execution under the context of NT AUTHORITY\SYSTEM. This issue has been addressed in version 4.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-284
References: https://github.com/wazuh/wazuh/security/advisories/GHSA-pmr2-2r83-h3cv
CVE: CVE-2024-47770
Published: 2025-02-03
Description: Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtualized, containerized, and cloud-based environments. This vulnerability occurs when the system has weak privilege access, that allows an attacker to do privilege escalation. In this case the attacker is able to view agent list on Wazuh dashboard with no privilege access. This issue has been addressed in release version 4.9.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 4.6 (MEDIUM)
CWE: CWE-269
References: https://github.com/wazuh/wazuh/security/advisories/GHSA-648q-8m78-5cwv; https://github.com/wazuh/wazuh/security/advisories/GHSA-648q-8m78-5cwv
CVE: CVE-2025-22129
Published: 2025-02-03
Description: Tuleap is an Open Source Suite to improve management of software developments and collaboration. In affected versions an unauthorized user might get access to restricted information. This issue has been addressed in Tuleap Community Edition 16.3.99[PII_REDACTED], Tuleap Enterprise Edition 16.2-5, and Tuleap Enterprise Edition 16.3-2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-280
References: https://github.com/Enalean/tuleap/security/advisories/GHSA-f34g-wc2m-mf76; https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=3edf8158ba40be66f0b661888b8b[PII_REDACTED]d1; https://tuleap.net/plugins/tracker/?aid=41434
CVE: CVE-2025-23210
Published: 2025-02-03
Description: phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions have been found to have a Bypass of the Cross-site Scripting (XSS) sanitizer using the javascript protocol and special characters. This issue has been addressed in versions 3.9.0, 2.3.7, 2.1.8, and 1.29.9. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE: CWE-79
References: https://github.com/PHPOffice/PhpSpreadsheet/commit/cde2926a9e2baf146783f8fd1771bbed7d1dc7b3; https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-r57h-547h-w24f
CVE: CVE-2025-24029
Published: 2025-02-03
Description: Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users (possibly anonymous ones if the widget is used in the dashboard of a public project) might get access to artifacts they should not see. This issue has been addressed in Tuleap Community Edition 16.3.99[PII_REDACTED] as well as Tuleap Enterprise Edition 16.3-5 and Tuleap Enterprise Edition 16.2-7. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-280
References: https://github.com/Enalean/tuleap/security/advisories/GHSA-hq46-63pc-xfv9; https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=269cbaa73bac6d1c50674c48c9987263f2b38804; https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=a97480f951351c0f8f2f3f27f7daa3f7f9c37c75
CVE: CVE-2025-24371
Published: 2025-02-03
Description: CometBFT is a distributed, Byzantine fault-tolerant, deterministic state machine replication engine. In the `blocksync` protocol peers send their `base` and `latest` heights when they connect to a new node (`A`), which is syncing to the tip of a network. `base` acts as a lower ground and informs `A` that the peer only has blocks starting from height `base`. `latest` height informs `A` about the latest block in a network. Normally, nodes would only report increasing heights. If `B` fails to provide the latest block, `B` is removed and the `latest` height (target height) is recalculated based on other nodes `latest` heights. The existing code however doesn't check for the case where `B` first reports `latest` height `X` and immediately after height `Y`, where `X > Y`. `A` will be trying to catch up to 2000 indefinitely. This condition requires the introduction of malicious code in the full node first reporting some non-existing `latest` height, then reporting lower `latest` height and nodes which are syncing using `blocksync` protocol. This issue has been patched in versions 1.0.1 and 0.38.17 and all users are advised to upgrade. Operators may attempt to ban malicious peers from the network as a workaround.
CWE: CWE-703
References: https://github.com/cometbft/cometbft/releases/tag/v0.38.17; https://github.com/cometbft/cometbft/releases/tag/v1.0.1; https://github.com/cometbft/cometbft/security/advisories/GHSA-22qq-3xwm-r5x4
CVE: CVE-2025-24901
Published: 2025-02-03
Description: WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `deletar_permissao.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to  or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-jp48-94wm-3gmc
CVE: CVE-2025-24902
Published: 2025-02-03
Description: WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `salvar_cargo.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to  or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/LabRedesCefetRJ/WeGIA/commit/f535e873a8f26fe413d21f22e3eacc8c79b2fa7f; https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-pg73-w9vx-8mgp
CVE: CVE-2025-24905
Published: 2025-02-03
Description: WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_codigobarras_cobranca.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to  or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qjc6-5qv6-fr8m
CVE: CVE-2025-24906
Published: 2025-02-03
Description: WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_detalhes_cobranca.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to  or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-jpph-g9p7-9jrm
CVE: CVE-2025-24957
Published: 2025-02-03
Description: WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `get_detalhes_socio.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to  or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-x28g-6228-99p9
CVE: CVE-2025-24958
Published: 2025-02-03
Description: WeGIA is a Web Manager for Charitable Institutions. A SQL Injection vulnerability was discovered in the WeGIA application, `salvar_tag.php` endpoint. This vulnerability could allow an authorized attacker to execute arbitrary SQL queries, allowing access to  or deletion of sensitive information. This issue has been addressed in version 3.2.12 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-2mhx-5998-46hx