Which versions of WeGIA are affected by CVE-2025-6694?

CVE-2025-6694 is a low-severity vulnerability in A vulnerability involving cross-site scripting (CVSS 3.5).

Is there a public PoC exploit available for CVE-2025-6694?

Yes, a public proof-of-concept exploit is available for CVE-2025-6694. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-6694?

During next maintenance window: Apply vendor patches when convenient. Verify cross-site scripting controls are in place.

WeGIA CVE-2025-6694

Q: What is the CVSS score of CVE-2025-6694?

CVE-2025-6694 has a CVSS 4.0 base score of 2.0 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2025-19179 LOW

Cross-site Scripting (XSS) (CWE-79)

2025-06-26 cna@vuldb.com

PHP XSS Wegia

2.0

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.0 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

3.5 LOW

Requires low privileges and user interaction; only integrity impact, no confidentiality or availability.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

CVSS changed

Apr 29, 2026 - 01:11 NVD

3.5 (LOW) 2.0 (LOW)

EUVD ID Assigned

Mar 15, 2026 - 23:54 euvd

EUVD-2025-19179

Analysis Generated

Mar 15, 2026 - 23:54 vuln.today

PoC Detected

Jul 01, 2025 - 19:03 vuln.today

Public exploit code

CVE Published

Jun 26, 2025 - 14:15 cve.org

LOW 2.0

CVE Published

Jun 26, 2025 - 14:15 nvd

LOW 3.5

DescriptionCVE.org

A vulnerability has been found in LabRedesCefetRJ WeGIA 3.4.0 and classified as problematic. This vulnerability affects unknown code of the file /html/matPat/adicionar_unidade.php of the component Adicionar Unidade. The manipulation of the argument Insira a nova unidade leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Cross-site scripting in WeGIA 3.4.0 allows remote attackers to inject arbitrary web script via the 'Insira a nova unidade' parameter in the Adicionar Unidade page. The vendor has not responded to early disclosure, and public exploit code exists, but no evidence of active exploitation has been confirmed.

Technical ContextAI

The vulnerability resides in the PHP script /html/matPat/adicionar_unidade.php, part of the WeGIA open-source application. The parameter 'Insira a nova unidade' is reflected without proper output encoding, aligning with CWE-79 (Cross-Site Scripting). The affected product is identified as WeGIA version 3.4.0 via CPE cpe:2.3:a:wegia:wegia:3.4.0:*:*:*:*:*:*:*.

RemediationAI

No vendor-released patch is available as the vendor was contacted but did not respond. As a workaround, restrict access to the /html/matPat/adicionar_unidade.php endpoint or implement server-side input validation/sanitization for the 'Insira a nova unidade' parameter to strip or encode HTML tags. These mitigations may impact legitimate functionality if that field is intended to accept special characters. Monitor the VulDB entry for any potential future vendor fix.