PT-2025-29865 · Wegia · Wegia

Marcelomulder · CVE-2025-53936 · Published 2025-07-11 · Updated 2025-07-25

Positive Technologies (AI Summary)

CVSS v4.0

6.4

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.4.5

Description A Reflected Cross-Site Scripting (XSS) vulnerability exists in the personalizacao selecao.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts through the nome car parameter.

Recommendations Update WeGIA to version 3.4.5 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2025-09270

CVE-2025-53936

GHSA-34VC-Q923-V26P

Affected Products

Wegia

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53936.json · Exploit
• 🔥 https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-34vc-q923-v26p · Exploit
• https://bdu.fstec.ru/vul/2025-09270 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53936 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53936 · Security Note
• https://twitter.com/VulmonFeeds/status/1945594427113644344 · Twitter Post
• https://twitter.com/dailycve/status/1948832727329112434 · Twitter Post
• https://t.me/cvetracker/27981 · Telegram Post
• https://twitter.com/CVEnew/status/1945562947599683810 · Twitter Post