Stored Cross-Site Scripting in WeGIA Web Manager

CVE-2025-53930

What is CVE-2025-53930?

WeGIA, an open-source web manager tailored for Portuguese-speaking users and charitable organizations, contains a Stored Cross-Site Scripting (XSS) vulnerability in the adicionar_especie.php endpoint prior to version 3.4.5. This flaw allows attackers to insert malicious scripts into the especie parameter, where they are stored on the server. Once injected, these scripts are executed automatically whenever users access the impacted page, significantly increasing the risk of unauthorized access and data compromise. It is crucial for users to upgrade to version 3.4.5 or later to mitigate this risk.

References