CVE-2025-62597: WeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar_info_pessoal.php' Parameter 'sql'
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to version 3.5.1, a reflected cross-site scripting (XSS) vulnerability was identified in the editarinfopessoal.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the sql parameter. The vulnerable endpoint is GET /WeGIA/html/pessoa/editarinfopessoal.php?sql=1. This issue has been patched in version 3.5.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIAto a version that resolves this vulnerability.Fixed in 3.5.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62597?
CVE-2025-62597 has been classified with a medium severity due to the potential impact of reflected cross-site scripting.
How do I fix CVE-2025-62597?
To fix CVE-2025-62597, upgrade to WeGIA version 3.5.1 or later.
What is the impact of CVE-2025-62597?
The impact of CVE-2025-62597 is that it allows attackers to execute arbitrary JavaScript in the context of a user's browser session.
Which versions are affected by CVE-2025-62597?
All versions of WeGIA prior to 3.5.1 are affected by CVE-2025-62597.
How can I mitigate CVE-2025-62597 if I cannot update?
If an update is not possible, consider implementing Content Security Policy (CSP) to help mitigate the risk of reflected XSS.