VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Dec 9, 2025· Updated Jun 17, 2026

CVE-2025-67496

CVE-2025-67496

Description

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Versions 3.5.4 and below contain a Stored Cross-Site Scripting (XSS) vulnerability in the /WeGIA/html/geral/configurar_senhas.php endpoint. The application does not sanitize user-controlled data before rendering it inside the employee selection dropdown. The application retrieves employee names from the database and injects them directly into HTML elements without proper escaping. This issue is fixed in version 3.5.5.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

3
  • Wegia/Wegia2 versions
    cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:*range: <3.5.5
    • (no CPE)range: <=3.5.4
  • LabRedesCefetRJ/Wegiav5
    Range: < 3.5.5

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.