CVE-2025-57762 MEDIUM

CVE-2025-57762: WeGIA Stored Cross-Site Scripting (XSS) vulnerability in the endpoint 'dependente_docdependente.php' with parameter 'nome'

Vendor Labredescefetrj
Product WeGIA
Weakness CWE-79 · XSS
Published August 21, 2025
Last update August 21, 2025
View on NVD All CVEs

CVSS base score

6.4/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H

What the vulnerability does

01Description

WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, there is a Stored Cross-Site Scripting (XSS) vulnerability in the dependente_docdependente.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the nome parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. This vulnerability is fixed in 3.4.7.

Key dates

02Disclosure timeline

August 21, 2025 CVE published
August 21, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2022-34330 IBM Sterling B2B Integrator cross-site scripting CVE-2025-67708 Reflected cross-site scripting (XSS) vulnerability in ArcGIS Server. CVE-2024-10091 ElementsKit Elementor addons <= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison Widget CVE-2025-26980 WordPress Wired Impact Volunteer Management plugin <= 2.5 - Stored Cross Site Scripting (XSS) vulnerability CVE-2026-8078 Fix stored XSS in global settings change log