CVE-2025-30362: WeGIA vulnerable to Stored XSS in documentos_funcionario.php parameter id
WeGIA is a Web manager for charitable institutions. A stored Cross-Site Scripting (XSS) vulnerability was identified in versions prior to 3.2.8. This vulnerability allows unauthorized scripts to be executed within the user's browser context. Stored XSS is particularly critical, as the malicious code is permanently stored on the server and executed whenever a compromised page is loaded, affecting all users accessing this page. Version 3.2.8 fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30362?
CVE-2025-30362 is classified as a critical vulnerability due to its potential for exploitation via stored Cross-Site Scripting.
How do I fix CVE-2025-30362?
To mitigate CVE-2025-30362, upgrade the WeGIA Web Manager to version 3.2.8 or later.
What versions of WeGIA are affected by CVE-2025-30362?
CVE-2025-30362 affects all versions of WeGIA Web Manager prior to 3.2.8.
What type of vulnerability is CVE-2025-30362?
CVE-2025-30362 is a stored Cross-Site Scripting (XSS) vulnerability.
What is stored Cross-Site Scripting as seen in CVE-2025-30362?
Stored Cross-Site Scripting allows malicious scripts to be stored on the server and executed within the user's browser context.