PT-2025-9536 · Wegia · Wegia

Lislovelly · Published 2025-03-03 · Updated 2025-03-04 · CVE-2025-27499

Positive Technologies (AI Summary)

CVSS v4.0

6.4

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.2.10

Description A Stored Cross-Site Scripting (XSS) vulnerability was identified in the "processa edicao socio.php" endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the socio nome parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk.

Recommendations For versions prior to 3.2.10, update to version 3.2.10 to fix the vulnerability. As a temporary workaround, consider restricting access to the "processa edicao socio.php" endpoint or disabling the socio nome parameter to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-27499

GHSA-V248-MR5R-87PF

Affected Products

Wegia

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27499.json · Exploit
• 🔥 https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-v248-mr5r-87pf · Exploit
• https://github.com/LabRedesCefetRJ/WeGIA/commit/1ac0d0701ad93103482374e8092ad1a5ab15d3fc · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-27499 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27499 · Vendor Advisory
• https://t.me/cvenotify/113225 · Telegram Post
• https://t.me/cvedetector/19392 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1896783715621085629 · Twitter Post
• https://twitter.com/CVEnew/status/1896767588857790862 · Twitter Post