CVE-2025-62358: WeGIA Reflected XSS to Account TakeOver at /html/configuracao/configuracao_geral.php via log parameter
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to 3.5.1, the log parameter in configuracaogeral.php is vulnerable to Reflected Cross-Site Scripting (XSS). An attacker can inject arbitrary JavaScript, which executes in the victim’s browser. This vulnerability is fixed in 3.5.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIAto a version that resolves this vulnerability.Fixed in 3.5.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62358?
CVE-2025-62358 is considered a medium severity vulnerability due to its potential for exploitation through Reflected Cross-Site Scripting.
How do I fix CVE-2025-62358?
To fix CVE-2025-62358, upgrade WeGIA to version 3.5.1 or later where the vulnerability has been patched.
What type of vulnerability is CVE-2025-62358?
CVE-2025-62358 is identified as a Reflected Cross-Site Scripting (XSS) vulnerability.
Which versions of WeGIA are affected by CVE-2025-62358?
CVE-2025-62358 affects WeGIA versions prior to 3.5.1.
What can an attacker achieve by exploiting CVE-2025-62358?
An attacker exploiting CVE-2025-62358 can inject arbitrary JavaScript, potentially leading to unauthorized actions on behalf of users.