PT-2025-4601 · Wegia · Wegia

Lislovelly

·

Published

2025-01-13

·

Updated

2025-06-26

·

CVE-2025-22615

CVSS v4.0

6.4

Medium

VectorAV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H
Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.2.6
Description WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the Cadastro Atendido.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the cpf parameter. The application fails to validate and sanitize user inputs in the cpf parameter. This lack of validation permits the injection of malicious payloads, which are reflected back to the user's browser in the server's response and executed within the context of the victim's browser.
Recommendations For versions prior to 3.2.6, upgrade to version 3.2.6 to address the issue. As a temporary workaround, consider restricting access to the Cadastro Atendido.php endpoint or disabling the use of the cpf parameter until the issue is resolved. Avoid using the cpf parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-22615
GHSA-6Q73-74PC-P3C8

Affected Products

Wegia