High severity · published Mar 3, 2025
CVE-2025-27419
Denial of Service (DoS) in WeGIA due to Recursive Crawling of Dynamic URLs
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Denial of Service (DoS) vulnerability exists in WeGIA. This vulnerability allows any unauthenticated user to cause the server to become unresponsive by performing aggressive spidering. The vulnerability is caused by recursive crawling of dynamically generated URLs and insufficient handling of large volumes of requests. This vulnerability is fixed in 3.2.16.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
WeGIA · LabRedesCefetRJ
< 3.2.16 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-27419
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-27419
Patch
https://github.com/LabRedesCefetRJ/WeGIA/commit/624ddfadb3fd8f8b30ad4f601b032a9bacc86a39
Exploit
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-9rp6-4mqp-g4p8
More from WeGIA
9.8
CVE-2026-55684
WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php
9.8
CVE-2026-55680
WeGIA: Unauthenticated SQL Injection in cadastro_cobranca.php via "codigo" parameter
9.8
CVE-2026-55683
WeGIA: SQL Injection in html/socio/sistema/cadastro_cobranca.php
9.8
CVE-2026-31896
WeGIA has a Time-Based Blind SQL Injection in remover_produto_ocultar.php
9.8
CVE-2026-28411
WeGIA Vulnerable to Authentication Bypass via `extract($_REQUEST)`