Cross-site scripting in WeGIA - CVE-2026-45025
Published: May 7, 2026
Vulnerability identifier: #VU130448
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2026-45025
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary JavaScript in victims' browsers.
The vulnerability exists due to cross-site scripting in html/atendido/etapa_processo.php when rendering etapa descriptions. A remote privileged user can inject malicious HTML or JavaScript into the description field to execute arbitrary JavaScript in victims' browsers.
The injected script is stored and executed when users access the "Etapas de um Processo" page, which can lead to session hijacking and account takeover.
Affected software
WeGIA
How to mitigate CVE-2026-45025
Install security update from vendor's website.
WeGIA - update to 3.7.3