Cross-site scripting in WeGIA - #VU163012
Published: November 9, 2026
Vulnerability identifier: #VU163012
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to execute arbitrary JavaScript in the WeGIA application origin within an authenticated victim's browser.
The vulnerability exists due to unsafe request variable extraction in web/html/sucesso.php, allowing request parameters to overwrite session values rendered without HTML encoding. An unauthenticated remote attacker can send a crafted link to a victim with an active authenticated session, causing reflected cross-site scripting when the victim clicks it.
Affected software
WeGIA
Remediation
Install security update from vendor's website.
WeGIA - update to 3.9.4