PT-2025-4776 · Wegia · Wegia

Lislovelly

·

Published

2025-01-13

·

Updated

2025-07-01

·

CVE-2025-23030

CVSS v4.0

6.4

Medium

VectorAV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H
Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.2.6
Description A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the cadastro funcionario.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the cpf parameter. The application fails to validate and sanitize user inputs in the cpf parameter, permitting the injection of malicious payloads, which are reflected back to the user's browser in the server's response and executed within the context of the victim's browser.
Recommendations For versions prior to 3.2.6, upgrade to version 3.2.6 or later to address the issue. As a temporary workaround, consider restricting access to the cadastro funcionario.php endpoint until the upgrade is possible. Additionally, avoid using the cpf parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-23030
GHSA-88C9-GPGH-6VVR

Affected Products

Wegia