Stored XSS Vulnerability in WeGIA Web Manager for Charitable Institutions

CVE-2025-23038

What is CVE-2025-23038?

A Stored Cross-Site Scripting vulnerability has been identified in the WeGIA web management application. This issue exists in the remuneracao.php endpoint, where the application does not properly validate or sanitize user inputs. As a result, attackers can inject malicious scripts into the descricao parameter, which are stored on the server. When users access the affected page, the scripts execute within their browsers, potentially leading to data compromise and user system exploitation. It is crucial for all users to upgrade to version 3.2.6, as there are no workarounds available to mitigate this vulnerability.

References