Cross-Site Scripting Vulnerability in WeGIA Web Manager
CVE-2025-22132

4.8MEDIUM

Key Information:

Vendor

WeGIA

Status
Wegia
Vendor
CVE Published:
7 January 2025

What is CVE-2025-22132?

A Cross-Site Scripting (XSS) vulnerability has been discovered in the file upload feature of the WeGIA Web Manager, specifically within the controla_xlsx.php endpoint. This vulnerability allows attackers to upload a file that contains malicious JavaScript code. If successful, this can lead to arbitrary script execution in the victim's browser, potentially enabling attackers to steal sensitive information, hijack user sessions, and conduct various forms of exploitation on the client's side. The vulnerability has been addressed in version 3.2.7.

References

https://github.com/nilsonLazarin/WeGIA/commit/330f641db43...
https://github.com/nilsonLazarin/WeGIA/security/advisorie...

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.