PT-2025-40851 · Mangati · Mangati Novosga

Marceloqz · Published 2025-10-06 · Updated 2025-10-09 · CVE-2025-11322

Positive Technologies (AI Summary)

CVSS v3.1

3.7

Low

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Mangati NovoSGA versions up to 2.2.12

Description A weakness exists in Mangati NovoSGA up to version 2.2.12 related to weak password requirements during user creation. The issue is located in the User Creation Page component, specifically within the /novosga.users/new file and involves manipulation of the Senha/Confirmação da senha argument. This can be exploited remotely, but requires a high level of complexity and is considered difficult to execute. The exploit has been published. The vendor was notified but did not respond.

Recommendations Versions prior to 2.2.12 should be updated.

Exploit

Fix

Weakness Enumeration

CWE-521

Related Identifiers

CVE-2025-11322

GHSA-XGR2-5837-HF48

Affected Products

Mangati Novosga

References · 14

• 🔥 https://github.com/marcelomulder/CVE/blob/main/NovoSga/Weak%20Password%20Policy%20in%20Novosga.md · Exploit
• 🔥 https://github.com/marcelomulder/CVE/blob/main/NovoSga/CVE-2025-11322.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-11322 · Security Note
• https://osv.dev/vulnerability/GHSA-xgr2-5837-hf48 · Vendor Advisory
• https://github.com/novosga/novosga · Note
• https://t.me/CVEtracker/34208 · Telegram Post
• https://vuldb.com/?id.327203 · Note
• https://reddit.com/r/VulnMatter/comments/1o120p5/resumen_diario_de_vulnerabilidades_08102025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1o1aw7v/resumen_diario_de_vulnerabilidades_08102025 · Reddit Post
• https://vuldb.com/?submit.664517 · Note
• https://t.me/cveNotify/137454 · Telegram Post
• https://reddit.com/r/VulnMatter/comments/1o28ww8/resumen_diario_de_vulnerabilidades_09102025 · Reddit Post
• https://twitter.com/CVEnew/status/1975076132278944151 · Twitter Post
• https://vuldb.com/?ctiid.327203 · Note