WeGIA CVE-2025-62178

Exploitation requires an authenticated WeGIA session (PR:L) because the vulnerable endpoint /html/atendido/cadastro_atendido_parentesco_pessoa_nova.php sits within the application's managed area, and it requires the victim to click an attacker-crafted link carrying a payload in the idatendido GET parameter (UI:R). The specific trigger is the unsanitized reflection of $_GET['idatendido'] into a hidden input's value attribute. Limiting factors: both a valid low-privilege account and victim interaction are needed, impact is confined to the browser (C:L/I:L, no availability impact), and any instance updated to WeGIA 3.5.1 or later is not vulnerable.

This is a genuinely moderate-but-not-urgent issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, 5.4 Medium) describes a reflected XSS requiring both authentication (PR:L) and victim interaction (UI:R) to click a crafted link, with only limited confidentiality and integrity impact (C:L/I:L) achieved through a changed scope (S:C, script running in the victim's browser context). The signals are internally consistent and align with the commit evidence: the sink is an unescaped $_GET['idatendido'] echoed into a hidden input, which is a textbook reflected XSS. EPSS is low at 0.24% (13th percentile), indicating low probability of mass exploitation, and the CVE is NOT on CISA KEV, so there is no evidence of active exploitation. A POC does exist (the GitHub Security Advisory GHSA-fj32-779r-28qv documents the vector), so publicly available exploit code exists - but POC availability is distinct from active exploitation and should not be conflated. Net: this is a real, confirmed, low-complexity bug worth patching in routine cycles, but the authentication + user-interaction prerequisites plus limited impact and low real-world footprint make it a low-to-medium operational priority rather than an emergency.

An attacker with a low-privileged WeGIA account crafts a URL to /html/atendido/cadastro_atendido_parentesco_pessoa_nova.php with a malicious script payload in the idatendido parameter and lures an authenticated victim into clicking it. The reflected payload executes in the victim's browser session, enabling session/credential theft or actions in the victim's context. A POC is publicly documented in the GitHub Security Advisory, and low attack complexity makes reliable exploitation straightforward once a victim clicks.