Stored Cross-Site Scripting Vulnerability in WeGIA by LabRedesCefetRJ

CVE-2025-22613

Summary

WeGIA, an open source web management application targeting Portuguese-speaking charitable institutions, is vulnerable to Stored Cross-Site Scripting (XSS). The flaw exists in the informacao_adicional.php endpoint where user input is not properly validated or sanitized. This allows attackers to inject malicious scripts through the descricao parameter, which are then stored on the server. When the affected page is accessed, these scripts execute in the browsers of users, potentially leading to data theft and system compromise. Users are strongly advised to update to version 3.2.6 to mitigate this security risk, as there are no known workarounds.

References