CVE-2025-27420

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-27420
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the atendido_parentesco_adicionar.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the descricao parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. This vulnerability fix in 3.2.16.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/LabRedesCefetRJ/WeGIA/commit/add78bb177cbb29477ff2121b533651a9d673918 Patch
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-x3wr-75qx-55cw Exploit Vendor Advisory
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-x3wr-75qx-55cw Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:*
History

10 Apr 2025, 18:29

Type Values Removed Values Added
References () https://github.com/LabRedesCefetRJ/WeGIA/commit/add78bb177cbb29477ff2121b533651a9d673918 - () https://github.com/LabRedesCefetRJ/WeGIA/commit/add78bb177cbb29477ff2121b533651a9d673918 - Patch
References () https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-x3wr-75qx-55cw - () https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-x3wr-75qx-55cw - Exploit, Vendor Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.4
Summary
  • (es) WeGIA es un gestor web de código abierto para instituciones enfocado en usuarios de lengua portuguesa. Se identificó una vulnerabilidad de cross-site scripting (XSS) almacenado en el endpoint atendido_parentesco_adicionar.php de la aplicación WeGIA. Esta vulnerabilidad permite a los atacantes inyectar secuencias de comandos maliciosas en el parámetro descricao. Las secuencias de comandos inyectadas se almacenan en el servidor y se ejecutan automáticamente cada vez que los usuarios acceden a la página afectada, lo que supone un riesgo de seguridad significativo. Esta vulnerabilidad se corrige en la versión 3.2.16.
First Time Wegia
Wegia wegia
CPE cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:*

04 Mar 2025, 17:15

Type Values Removed Values Added
References () https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-x3wr-75qx-55cw - () https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-x3wr-75qx-55cw -

03 Mar 2025, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-03 16:15

Updated : 2025-04-10 18:29

NVD link : CVE-2025-27420

Mitre link : CVE-2025-27420

CVE.ORG link : CVE-2025-27420

JSON object : View

Products Affected

wegia

  • wegia
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')