PT-2025-13386 · Wegia · Wegia

Nmmorette · Publicado 2025-03-27 · Atualizado 2025-03-29 · CVE-2025-30366

Positive Technologies (AI Summary)

CVSS v4.0

6.2

Média

Vetor base

AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.2.8

Description The issue allows unauthorized scripts to be executed within the user's browser context due to stored cross-site scripting. This type of scripting is particularly critical because the malicious code is permanently stored on the server and executed whenever a compromised page is loaded, affecting all users accessing this page.

Recommendations For versions prior to 3.2.8, update to version 3.2.8 to fix the issue. As a temporary workaround, consider restricting access to potentially compromised pages until the update is applied.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-30366

GHSA-PWR9-FR8R-8H48

Produtos afetados

Wegia

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30366.json · Exploit
• 🔥 https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-pwr9-fr8r-8h48 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-30366 · Nota de Segurança
• https://twitter.com/VulmonFeeds/status/1905331625916870922 · Publicação no Twitter
• https://t.me/cvetracker/20098 · Publicação no Telegram
• https://t.me/cvedetector/21314 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-30366 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1905811760323379381 · Publicação no Twitter