EUVD-2026-29185Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L assigned because profile editing most plausibly requires a session; scope change reflects payload executing in victim browsers; no availability impact from XSS.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
WeGIA is a web manager for charitable institutions. In versions prior to 3.7.0, a Stored Cross-Site Scripting (XSS) flaw was identified at the following endpoint: funcionario/profile_funcionario.php?id_funcionario=2. By injecting a malicious payload into the 'Description' (Descrição) field and saving the profile, the script becomes persistently stored. The payload is subsequently executed whenever the profile page is accessed. This vulnerability is fixed in 3.7.0.
AnalysisAI
Stored XSS in WeGIA's employee profile module affects all versions prior to 3.7.0, enabling persistent JavaScript injection via the Description (Descrição) field at the funcionario/profile_funcionario.php endpoint. Any party able to edit that field can plant a payload that executes silently in every subsequent visitor's browser - including administrators - enabling session hijacking and privileged action execution. A proof-of-concept exists per SSVC assessment; however, no CISA KEV listing and an EPSS of 0.05% (15th percentile) indicate no observed widespread exploitation at time of analysis.
Technical ContextAI
WeGIA is a PHP-based charitable institution management web application developed by LabRedesCefetRJ (CPE: cpe:2.3:a:labredescefetrj:wegia:*:*:*:*:*:*:*:*). The root cause is CWE-79 - Improper Neutralization of Input During Web Page Generation - where the Descrição field on the employee profile page accepts user-supplied input that is persisted to the database and subsequently reflected into HTML responses without proper output encoding or sanitization. This is a classic stored (persistent) XSS pattern: the injection point (profile edit form) is decoupled from the execution point (profile view), meaning the payload delivers to every viewer independently and repeatedly without further attacker involvement. The CVSS 4.0 vector assigns high subsequent-system impact (SC:H/SI:H/SA:H), reflecting that scripts executing in an administrator's browser can compromise the broader application beyond the immediate vulnerable page.
RemediationAI
Upgrade to WeGIA 3.7.0, the vendor-released patch confirmed via GitHub advisory GHSA-q6jg-hfqv-882f (https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-q6jg-hfqv-882f). If immediate upgrade is not feasible, deploy a strict Content Security Policy (CSP) header on the WeGIA application that restricts script-src to trusted origins - note that an overly restrictive CSP may break legitimate WeGIA JavaScript functionality and must be tested before production deployment. As an additional compensating control, restrict write access to the employee profile Description field to trusted, authenticated roles only, reducing the attacker pool even if authentication is not currently enforced at that endpoint. A WAF rule blocking common XSS patterns (e.g., script tags, event handlers) on requests to profile_funcionario.php can provide a temporary barrier with low operational risk, though WAF rules alone are not a substitute for patching.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today