WeGIA CVE-2025-62358

Exploitation targets the 'log' GET parameter of html/configuracao/configuracao_geral.php, which is base64-decoded and rendered inside a <pre> tag without HTML escaping (fixed by adding htmlspecialchars() in the displaySuccess/displayWarning/displayError message helpers in html/geral/msg.php). The payload must be base64-encoded to pass through the base64_decode() call. The primary limiting factor is required user interaction (UI:R): the victim must open the attacker-supplied link, so exploitation depends on successful social engineering. No authentication is required to craft the link (PR:N), and the affected code path is present in default WeGIA installations prior to 3.5.1.

This is a moderate-severity Reflected XSS (CWE-79) with a balanced, non-alarming real-world risk profile. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1) indicates network-reachable, low-complexity, unauthenticated exploitation but critically requires user interaction (UI:R) - the victim must open an attacker-crafted link, which is the dominant limiting factor. The scope change (S:C) reflects script execution crossing from the server-rendered page into the victim's browser context, consistent with the limited C:L/I:L impact of reflected XSS. Exploitation signals are mixed but coherent: a public exploit exists (GHSA-g6hr-2rhx-f8q4) yet EPSS is low at 0.26% (16th percentile) and the CVE is NOT in CISA KEV, so there is publicly available exploit code but no evidence of active exploitation. These signals do not conflict - a low EPSS alongside available POC code is typical for a niche product requiring user interaction. Bottom line: a legitimate bug worth patching, but not an emergency; prioritize behind unauthenticated RCEs and KEV-listed issues. No SSVC decision data was provided in the input.

An attacker crafts a URL to configuracao_geral.php with a malicious payload in the base64-encoded 'log' parameter and delivers it to a WeGIA user (e.g., an institution administrator) via phishing or a chat message. When the victim opens the link, the decoded, unescaped value is reflected into a <pre> block and the injected JavaScript executes in their browser, enabling session/cookie theft or actions in the WeGIA interface. A public POC exists via the GitHub security advisory, lowering the skill barrier.