CVE-2025-62598: WeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar_info_pessoal.php' Parameter 'action'
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to version 3.5.1, a reflected cross-site scripting (XSS) vulnerability was identified in the editarinfopessoal.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the action parameter. The vulnerable endpoint is GET /WeGIA/html/pessoa/editarinfopessoal.php?action=1. This issue has been patched in version 3.5.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WeGIAto a version that resolves this vulnerability.Fixed in 3.5.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62598?
CVE-2025-62598 is classified as a reflected cross-site scripting (XSS) vulnerability which can lead to unauthorized access and data compromise.
How do I fix CVE-2025-62598?
To mitigate CVE-2025-62598, upgrade to WeGIA version 3.5.1 or later.
What impact does CVE-2025-62598 have on users?
CVE-2025-62598 may allow attackers to execute scripts in the context of the victim's browser, potentially leading to data theft or session hijacking.
Which versions of WeGIA are affected by CVE-2025-62598?
CVE-2025-62598 affects all WeGIA versions prior to 3.5.1.
Where can I find more information about CVE-2025-62598?
For more details on CVE-2025-62598, refer to security advisories published by the WeGIA project.