PT-2025-4782 · Wegia · Wegia

Lislovelly · Published 2025-01-13 · Updated 2025-01-14 · CVE-2025-23036

Positive Technologies (AI Summary)

CVSS v4.0

6.4

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.2.7

Description A Reflected Cross-Site Scripting (XSS) issue was identified in the "pre cadastro funcionario.php" endpoint of the WeGIA application. This issue allows attackers to inject malicious scripts in the msg e parameter due to the application's failure to validate and sanitize user inputs. The lack of validation permits the injection of malicious payloads, which are reflected back to the user's browser in the server's response and executed within the context of the victim's browser.

Recommendations For versions prior to 3.2.7, upgrade to version 3.2.7 to address the issue. As a temporary workaround, consider restricting access to the pre cadastro funcionario.php endpoint until the upgrade is applied. Avoid using the msg e parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-23036

GHSA-2VPG-J5JH-J22X

Affected Products

Wegia

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/23xxx/CVE-2025-23036.json · Exploit
• 🔥 https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-2vpg-j5jh-j22x · Exploit
• https://github.com/LabRedesCefetRJ/WeGIA/commit/8369b75f88e64916151e5413a8b7d517d438d7a9 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-23036 · Security Note
• https://osv.dev/vulnerability/CVE-2025-23036 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1879057365762244948 · Twitter Post
• https://twitter.com/CVEnew/status/1879010784342376878 · Twitter Post
• https://t.me/cvedetector/15211 · Telegram Post