EUVD-2026-25666Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
9DescriptionCVE.org
A vulnerability was found in projeto-siga siga 11.0.3.18. The affected element is an unknown function of the file /sigawf/app/responsavel/novo. Performing a manipulation of the argument Nome/Descrição results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Stored cross-site scripting (XSS) in projeto-siga SIGA 11.0.3.18 allows authenticated remote attackers to inject malicious scripts via the Nome/Descrição parameter in the /sigawf/app/responsavel/novo endpoint. Successful exploitation requires user interaction (UI:R) and an authenticated session (PR:L), limiting impact to information disclosure (I:L). Public exploit code is available, though exploitation remains constrained by authentication and user interaction requirements.
Technical ContextAI
The vulnerability exists in SIGA's responsável (responsible party) management module at the /sigawf/app/responsavel/novo endpoint. The application fails to properly sanitize or encode user-supplied input in the Nome/Descrição field before storing and reflecting it in the web interface. This is a classic stored XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) where attacker-controlled data enters the application, persists in storage, and is later rendered in the HTML context without escaping. The attack vector is network-based, and the complexity is low, indicating a straightforward input manipulation without special bypasses required.
RemediationAI
Apply a security patch when released by the projeto-siga team. Until an official patch is available, implement the following compensating controls: (1) Apply input validation and output encoding to all user-supplied data in the /sigawf/app/responsavel/novo endpoint, particularly the Nome/Descrição parameter - encode special HTML characters (< > " ') before storing or rendering. (2) Implement a Content Security Policy (CSP) header restricting inline script execution and script source origins, which will mitigate reflected and stored XSS impact if injected content reaches the browser. (3) Restrict access to the /sigawf/app/responsavel/novo administrative endpoint to trusted IP ranges or require additional authentication (e.g., MFA). (4) Monitor server logs and database audit trails for suspicious characters or payloads in the Nome/Descrição field (e.g., script tags, event handlers). (5) Educate administrators and authorized users not to click links from untrusted sources within SIGA. Contact the projeto-siga development team via GitHub (https://github.com/projeto-siga/siga/) to request priority patching. References: VulDB #359542, GitHub issue #2491.
Missing authorization in projeto-siga Siga's authentication controller allows unauthenticated remote attackers to bypass
Server-side request forgery in projeto-siga SIGA up to version 11.1.1 allows unauthenticated remote attackers to cause t
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today