Executive brief
WeGIA, a web-based management platform for charitable institutions, contains a security vulnerability that allows attackers to inject malicious scripts into staff profile pages. If an attacker saves a malicious script in the 'Description' field of a profile, that script will run automatically whenever any user views that profile. This could lead to the theft of sensitive user data, such as login credentials or personal information, and potentially allow attackers to perform actions on behalf of legitimate users.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in WeGIA versions prior to 3.7.0. The flaw is located in the 'descricao' (Description) parameter within the informacao_adicional.php component, which is reflected on the staff profile page (funcionario/profile_funcionario.php). An attacker can inject arbitrary JavaScript into this field; because the application fails to properly neutralize the input before storage and subsequent rendering, the payload executes in the context of any user who views the affected profile. This can be used for session hijacking, keylogging, or DOM manipulation to harvest credentials. The issue is resolved in version 3.7.0.
Affected products
- LabRedesCefetRJ WeGIA < 3.7.0
Timeline
- 2026-04-24: advisory: GitHub Security Advisory published
- 2026-05-11: disclosed: CVE published to NVD