WeGIA CVE-2025-62359

Exploitation requires reaching /pet/profile_pet.php, which is behind an authenticated session and a specific permission check (permissao($_SESSION['id_pessoa'], 63, 7)) - consistent with PR:L - so an attacker needs a victim who is logged in and authorized for the pet module. The reflected XSS triggers because, prior to 3.5.0, the id_pet GET parameter is reflected without sanitization; the patch applies filter_input with FILTER_SANITIZE_NUMBER_INT and rejects non-numeric/invalid ids. Limiting factors: the victim must be authenticated to the WeGIA instance, must open an attacker-supplied crafted link (realistic user interaction despite the vendor's UI:N), and impact is confined to the victim's browser context (no server-side confidentiality/integrity/availability impact).

This is a moderate-severity, low-priority reflected XSS (CWE-79) in a niche open-source product, and the signals are consistent rather than conflicting. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and the 5.3 base score indicate network-reachable, low-complexity exploitation but requiring low-level privileges (PR:L) and producing only subsequent-system impact (SC:L/SI:L) - i.e., script execution in a victim's browser, not on the server. EPSS is low at 0.23% (13th percentile), and the vulnerability is NOT on the CISA KEV list, so there is no evidence of active exploitation. A public exploit does exist via the GitHub Security Advisory (GHSA-68mw-h9q4-j34f), but POC availability is a distinct signal from active exploitation and should not be conflated with it. One notable inconsistency: the vendor vector sets UI:N, yet a reflected XSS realistically requires a victim to open a crafted link, which normally warrants user interaction (UI:P/UI:R) - this appears to overstate ease of exploitation and should be verified. Net assessment: real but low operational priority - typical for reflected XSS in an obscure product with low EPSS and no KEV listing; prioritize patching but not as an emergency.

An attacker crafts a URL to /pet/profile_pet.php?id_pet= containing a malicious script in the id_pet parameter and lures an authenticated WeGIA user (one holding the pet-module permission) into opening it. Because the pre-3.5.0 code reflects id_pet without sanitization, the script executes in the victim's browser session, enabling session/cookie theft or actions in the victim's context. A public exploit is available through the GitHub Security Advisory.