PT-2025-9536 · Wegia · Wegia

Lislovelly · Publicado 2025-03-03 · Atualizado 2025-03-04 · CVE-2025-27499

Positive Technologies (AI Summary)

CVSS v4.0

6.4

Média

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.2.10

Description A Stored Cross-Site Scripting (XSS) vulnerability was identified in the "processa edicao socio.php" endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the socio nome parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk.

Recommendations For versions prior to 3.2.10, update to version 3.2.10 to fix the vulnerability. As a temporary workaround, consider restricting access to the "processa edicao socio.php" endpoint or disabling the socio nome parameter to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-27499

GHSA-V248-MR5R-87PF

Produtos afetados

Wegia

Referências · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27499.json · Exploit
• 🔥 https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-v248-mr5r-87pf · Exploit
• https://github.com/LabRedesCefetRJ/WeGIA/commit/1ac0d0701ad93103482374e8092ad1a5ab15d3fc · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2025-27499 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-27499 · Aviso do Fabricante
• https://t.me/cvenotify/113225 · Publicação no Telegram
• https://t.me/cvedetector/19392 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1896783715621085629 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1896767588857790862 · Publicação no Twitter