CVE-2025-27499

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-27499
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the processa_edicao_socio.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the socio_nome parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. This vulnerability is fixed in 3.2.10.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/LabRedesCefetRJ/WeGIA/commit/1ac0d0701ad93103482374e8092ad1a5ab15d3fc Patch
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-v248-mr5r-87pf Exploit Vendor Advisory
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-v248-mr5r-87pf Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:*
History

06 Mar 2025, 12:21

Type Values Removed Values Added
References () https://github.com/LabRedesCefetRJ/WeGIA/commit/1ac0d0701ad93103482374e8092ad1a5ab15d3fc - () https://github.com/LabRedesCefetRJ/WeGIA/commit/1ac0d0701ad93103482374e8092ad1a5ab15d3fc - Patch
References () https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-v248-mr5r-87pf - () https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-v248-mr5r-87pf - Exploit, Vendor Advisory
Summary
  • (es) WeGIA es un gestor web de código abierto para instituciones enfocado en los usuarios de lengua portuguesa. Se identificó una vulnerabilidad de tipo Cross-Site Scripting (XSS) Almacenado en el endpoint processa_edicao_socio.php de la aplicación WeGIA. Esta vulnerabilidad permite a los atacantes inyectar secuencias de comandos maliciosas en el parámetro socio_nome. Las secuencias de comandos inyectadas se almacenan en el servidor y se ejecutan automáticamente cada vez que los usuarios acceden a la página afectada, lo que supone un riesgo de seguridad significativo. Esta vulnerabilidad se corrigió en la versión 3.2.10.
First Time Wegia
Wegia wegia
CPE cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.1

04 Mar 2025, 17:15

Type Values Removed Values Added
References () https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-v248-mr5r-87pf - () https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-v248-mr5r-87pf -

03 Mar 2025, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-03 19:15

Updated : 2025-03-06 12:21

NVD link : CVE-2025-27499

Mitre link : CVE-2025-27499

CVE.ORG link : CVE-2025-27499

JSON object : View

Products Affected

wegia

  • wegia
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')