WeGIA CVE-2025-62598

Exploitation requires a victim with access to the WeGIA application to open an attacker-crafted URL targeting GET /WeGIA/html/pessoa/editar_info_pessoal.php?action=<payload>; the 'action' parameter is reflected without sanitization. The practical limiting factors are: (1) required user interaction - the victim must click or load the malicious link, (2) the payload executes only in the victim's browser context so impact is confined to that user's session (reflected, not stored/persistent), and (3) deployments must be on versions prior to 3.5.1. No server-side authentication is needed to craft the link, but meaningful impact depends on targeting an authenticated/active WeGIA user.

This is a reflected cross-site scripting (CWE-79) flaw in the WeGIA institutional web manager, carrying a moderate CVSS 4.0 base of 6.9. The real-world risk is modest and bounded. EPSS is low at 0.24% (14th percentile), indicating little predicted mass-exploitation activity, and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation. However, publicly available exploit code exists via the GitHub Security Advisory GHSA-jmm7-rr7w-f223, which lowers the barrier to opportunistic use. The signals are internally consistent (low EPSS, no KEV, reflected rather than stored XSS). Note a key tension in the vendor-supplied CVSS 4.0 vector: it specifies PR:N/UI:N and sets only SI:L (subsequent-system integrity) with VC:N/VI:N/VA:N - yet a reflected XSS realistically requires the victim to click an attacker-crafted link (user interaction) and primarily impacts the victim's browser session (confidentiality/integrity of session data). The UI:N choice is questionable for a reflected-XSS and likely understates the interaction requirement while the impact mapping is plausible but conservative - verify intent with the vendor advisory. Overall this is a low-to-moderate priority issue typical of reflected XSS: real but gated by user interaction and limited to session-level impact.

An attacker crafts a malicious URL embedding JavaScript in the 'action' parameter of GET /WeGIA/html/pessoa/editar_info_pessoal.php and delivers it to a logged-in WeGIA user via phishing email or a planted link. When the victim opens the link, the unsanitized parameter is reflected into the page and the script executes in their browser session, enabling session-token theft, CSRF-style actions, or UI redressing. Public proof-of-concept exploit detail is available in the GitHub Security Advisory (GHSA-jmm7-rr7w-f223).