PT-2025-4605 · Wegia · Wegia

Lislovelly · Published 2025-01-13 · Updated 2025-02-13 · CVE-2025-22619

Positive Technologies (AI Summary)

CVSS v4.0

6.4

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.2.6

Description A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the editar permissoes.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg c parameter. The application fails to validate and sanitize user inputs in the msg c parameter, permitting the injection of malicious payloads, which are reflected back to the user's browser in the server's response and executed within the context of the victim's browser.

Recommendations For WeGIA versions prior to 3.2.6, upgrade to version 3.2.6 or later to address the vulnerability. As a temporary workaround, consider restricting access to the editar permissoes.php endpoint until the issue is resolved. Avoid using the msg c parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-22619

GHSA-JFJJ-7RGC-6J2M

Affected Products

Wegia

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/22xxx/CVE-2025-22619.json · Exploit
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-jfjj-7rgc-6j2m · Vendor Advisory
• https://github.com/LabRedesCefetRJ/WeGIA/commit/f1233c30f00398f7a02fd9dd9cd46fb35098f2a4 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-22619 · Security Note
• https://osv.dev/vulnerability/CVE-2025-22619 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1879026642632241179 · Twitter Post
• https://twitter.com/CVEnew/status/1878913133210640493 · Twitter Post
• https://t.me/cvedetector/15180 · Telegram Post
• https://t.me/cvenotify/111291 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1879125689384767911 · Twitter Post