CVE-2025-67496

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Versions 3.5.4 and below contain a Stored Cross-Site Scripting (XSS) vulnerability in the /WeGIA/html/geral/configurar_senhas.php endpoint. The application does not sanitize user-controlled data before rendering it inside the employee selection dropdown. The application retrieves employee names from the database and injects them directly into HTML <option> elements without proper escaping. This issue is fixed in version 3.5.5.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/LabRedesCefetRJ/WeGIA/commit/c80b8cacd310fd459df61c030fb267c5e68cafc7	Patch
https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.5.5	Release Notes
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-9843-qm67-73h2	Exploit Vendor Advisory
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-9843-qm67-73h2	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:*

History

14 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) WeGIA es un gestor web de código abierto para instituciones con un enfoque en usuarios de habla portuguesa. Las versiones 3.5.4 e inferiores contienen una vulnerabilidad de cross-site scripting (XSS) almacenado en el endpoint /WeGIA/html/geral/configurar_senhas.php. La aplicación no sanea los datos controlados por el usuario antes de renderizarlos dentro del desplegable de selección de empleados. La aplicación recupera los nombres de los empleados de la base de datos y los inyecta directamente en elementos HTML <option> sin el escape adecuado. Este problema está corregido en la versión 3.5.5.

Information

Published : 2025-12-09 23:16

Updated : 2026-10-14 21:10

NVD link : CVE-2025-67496

Mitre link : CVE-2025-67496

CVE.ORG link : CVE-2025-67496

JSON object : View

Products Affected

wegia

wegia

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-67496", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-67496", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-10T16:13:32.099188Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "LabRedesCefetRJ", "product": "WeGIA", "versions": [{"status": "affected", "version": "< 3.5.5"}]}]}], "published": "2025-12-09T23:16:00.110", "references": [{"url": "https://github.com/LabRedesCefetRJ/WeGIA/commit/c80b8cacd310fd459df61c030fb267c5e68cafc7", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.5.5", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-9843-qm67-73h2", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-9843-qm67-73h2", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Versions 3.5.4 and below contain a Stored Cross-Site Scripting (XSS) vulnerability in the /WeGIA/html/geral/configurar_senhas.php endpoint. The application does not sanitize user-controlled data before rendering it inside the employee selection dropdown. The application retrieves employee names from the database and injects them directly into HTML <option> elements without proper escaping. This issue is fixed in version 3.5.5."}, {"lang": "es", "value": "WeGIA es un gestor web de c\u00f3digo abierto para instituciones con un enfoque en usuarios de habla portuguesa. Las versiones 3.5.4 e inferiores contienen una vulnerabilidad de cross-site scripting (XSS) almacenado en el endpoint /WeGIA/html/geral/configurar_senhas.php. La aplicaci\u00f3n no sanea los datos controlados por el usuario antes de renderizarlos dentro del desplegable de selecci\u00f3n de empleados. La aplicaci\u00f3n recupera los nombres de los empleados de la base de datos y los inyecta directamente en elementos HTML <option> sin el escape adecuado. Este problema est\u00e1 corregido en la versi\u00f3n 3.5.5."}], "lastModified": "2026-10-14T21:10:00.183", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7D4A9A61-EFD9-42BF-B18E-79D2D657DEFD", "versionEndExcluding": "3.5.5"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}