PT-2025-29862 · Wegia · Wegia

Marcelomulder · Published 2025-07-11 · Updated 2025-07-25 · CVE-2025-53933

Positive Technologies (AI Summary)

CVSS v4.0

6.4

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.4.5

Description WeGIA is an open source web manager. A Stored Cross-Site Scripting (XSS) vulnerability exists in the adicionar enfermidade.php endpoint. This allows attackers to inject malicious scripts into the nome parameter, which are then stored on the server and executed when users access the affected page.

Recommendations Update WeGIA to version 3.4.5 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-09268

CVE-2025-53933

GHSA-6558-M8RP-5QG6

Affected Products

Wegia

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53933.json · Exploit
• 🔥 https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-6558-m8rp-5qg6 · Exploit
• https://bdu.fstec.ru/vul/2025-09268 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-53933 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53933 · Vendor Advisory
• https://t.me/cvetracker/27978 · Telegram Post
• https://twitter.com/CVEnew/status/1945562951160623281 · Twitter Post
• https://twitter.com/dailycve/status/1948823803364344314 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1945581627498750368 · Twitter Post