CVE-2025-62598

⚪ Do wiadomości

Wstrzyknięcie skryptów w WeGIA umożliwia atak XSS przez parametr akcji.

CVSS

6.1

EPSS

0.2%

Exploit

poc

Vendor

wegia

Opis źródłowy (NVD)

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to version 3.5.1, a reflected cross-site scripting (XSS) vulnerability was identified in the editar_info_pessoal.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the action parameter. The vulnerable endpoint is GET /WeGIA/html/pessoa/editar_info_pessoal.php?action=1. This issue has been patched in version 3.5.1.

exploit xss Brak patcha

Źródła i daty

Źródło	Wartość
NVD – CVSS	6.1
CISA KEV (aktywnie wykorzystywane)	Nie
FIRST EPSS (prawdopodobieństwo exploita)	0.2%
Opublikowano (NVD)	2025-10-21 17:15:41 UTC
Ostatnia modyfikacja (NVD)	2026-09-30 23:10:00 UTC

Referencje

https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.5.1 ([email protected]) [Release Notes]
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-jmm7-rr7w-f223 ([email protected]) [Exploit, Third Party Advisory]