CVE-2026-45025: WeGIA: Stored XSS in html/atendido/etapa_processo.php
WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript into the "Etapas de um Processo" (html/atendido/etapaprocesso.php) page, which is executed when user access the the page, enabling session hijacking and account takeover. This vulnerability is fixed in 3.7.3.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45025?
The severity of CVE-2026-45025 is considered medium due to the potential for authenticated users to exploit the Stored XSS vulnerability.
How do I fix CVE-2026-45025?
To fix CVE-2026-45025, upgrade WeGIA to version 3.7.3 or later to mitigate the Stored XSS vulnerability.
Who is affected by CVE-2026-45025?
CVE-2026-45025 affects users of WeGIA versions prior to 3.7.3 that allow authenticated users to inject malicious scripts.
What type of vulnerability is CVE-2026-45025?
CVE-2026-45025 is a Stored Cross-Site Scripting (XSS) vulnerability found in WeGIA.
What can attackers do with CVE-2026-45025?
Attackers can leverage CVE-2026-45025 to inject malicious JavaScript code into the application, potentially compromising user data and session integrity.