CVE-2025-22132: WeGIA has a Cross-Site Scripting (XSS) in File Upload Field
WeGIA is a web manager for charitable institutions. A Cross-Site Scripting (XSS) vulnerability was identified in the file upload functionality of the WeGIA/html/socio/sistema/controller/controlaxlsx.php endpoint. By uploading a file containing malicious JavaScript code, an attacker can execute arbitrary scripts in the context of a victim's browser. This can lead to information theft, session hijacking, and other forms of client-side exploitation. This vulnerability is fixed in 3.2.7.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-22132?
CVE-2025-22132 is classified as a Cross-Site Scripting (XSS) vulnerability, which can lead to unauthorized access and data manipulation.
How do I fix CVE-2025-22132?
To fix CVE-2025-22132, upgrade WeGIA to version 3.2.7 or later, where the vulnerability has been addressed.
What can attackers do with CVE-2025-22132?
Attackers can exploit CVE-2025-22132 to upload malicious JavaScript code, allowing them to perform unauthorized actions or steal information from users.
Which software versions are affected by CVE-2025-22132?
WeGIA versions prior to 3.2.7 are affected by CVE-2025-22132.
Where is the vulnerability located in CVE-2025-22132?
The vulnerability in CVE-2025-22132 is located in the file upload functionality at the endpoint WeGIA/html/socio/sistema/controller/controla_xlsx.php.