CVE-2025-30366: WeGIA vulnerable to Stored XSS in personalizacao.php
WeGIA is a Web manager for charitable institutions. Versions prior to 3.2.8 are vulnerable to stored cross-site scripting. This vulnerability allows unauthorized scripts to be executed within the user's browser context. Stored XSS is particularly critical, as the malicious code is permanently stored on the server and executed whenever a compromised page is loaded, affecting all users accessing this page. Version 3.2.8 fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30366?
CVE-2025-30366 is considered a critical vulnerability due to its potential for exploiting stored cross-site scripting.
How do I fix CVE-2025-30366?
To fix CVE-2025-30366, upgrade WeGIA to version 3.2.8 or later, which addresses the stored cross-site scripting vulnerability.
What versions are affected by CVE-2025-30366?
CVE-2025-30366 affects all versions of WeGIA prior to version 3.2.8.
What is stored cross-site scripting in the context of CVE-2025-30366?
Stored cross-site scripting allows attackers to inject malicious scripts that are executed in the context of the user's browser, potentially leading to data theft or account compromise.
Who is impacted by CVE-2025-30366?
Users of WeGIA versions prior to 3.2.8 are at risk from CVE-2025-30366 due to the vulnerability in the web management system.