Stored Cross-Site Scripting Vulnerability in WeGIA Web Manager by LabRedesCefetRJ
CVE-2025-22597

8.3HIGH

Key Information:

Vendor
Labredescefetrj
Status
Wegia
Vendor
CVE Published:
10 January 2025

Summary

The WeGIA web manager for charitable institutions has a vulnerability that allows attackers to exploit a Stored Cross-Site Scripting (XSS) weakness in the CobrancaController.php endpoint. By injecting malicious scripts into the local_recepcao parameter, attackers can store harmful scripts on the server. These scripts execute automatically when other users access the affected pages, potentially compromising user data and the overall security of the application. This issue is remediated in version 3.2.8.

Affected Version(s)

WeGIA < 3.2.8

References

https://github.com/LabRedesCefetRJ/WeGIA/security/advisor...
x_refsource_CONFIRM

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.