CVE-2025-67496
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users.
Published Dec 9, 2025 · updated Oct 14, 2026 · wegia wegia
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Versions 3.5.4 and below contain a Stored Cross-Site Scripting (XSS) vulnerability in the /WeGIA/html/geral/configurar_senhas.php endpoint. The application does not sanitize user-controlled data before rendering it inside the employee selection dropdown. The application retrieves employee names from the database and injects them directly into HTML elements without proper escaping. This issue is fixed in version 3.5.5.
Timeline
Detection, updates, and resolution for this record.
Dec 9, 2025 · NIST NVD
Detected
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Versions 3.5.4 and below contain a Stored Cross-Site Scripting (XSS) vulnerability in the /WeGIA/html/geral/configurar_senhas.php endpoint. The application does not sanitize user-controlled data before rendering it inside the employee selection dropdown. The application retrieves employee names from the
Oct 14, 2026 · NIST NVD
Updated
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Versions 3.5.4 and below contain a Stored Cross-Site Scripting (XSS) vulnerability in the /WeGIA/html/geral/configurar_senhas.php endpoint. The application does not sanitize user-controlled data before rendering it inside the employee selection dropdown. The application retrieves employee names from the
Affected
- cpe wegia/wegiaversion unspecified
Sources
- CVE.orgCVE-2025-67496
Official CVE identifier
cve.org - FIRST EPSSCVE-2025-67496
30-day exploitation probability 0.2%
first.org - NIST NVDCVE-2025-67496
WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Versions 3.5.4 and below contain a Stored Cross-Site Scripting (XSS) vulnerability in the /WeGIA/html/geral/configurar_senhas.php endpoint. The application does not sanitize user-contr
nvd.nist.gov