CVE-2025-53931 - CVE House

Back to Database

Status published Medium CVE-2025-53931

WeGIA vulnerable to Stored Cross-Site Scripting via endpoint `adicionar_raca.php` parameter `raca`

6.4 CVSS

Vulnerability Description

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `adicionar_raca.php` endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to inject malicious scripts into the `raca` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. Version 3.4.5 fixes the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-53931

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-9mfp-wfmj-cg3j

More from LabRedesCefetRJ

View All →

LabRedesCefetRJ WeGIA Cadastro de Funcionário cadastro_funcionario.php cross site scripting

LabRedesCefetRJ WeGIA Adicionar tipo adicionar_tipoSaida.php cross site scripting

LabRedesCefetRJ WeGIA Adicionar tipo adicionar_tipoEntrada.php cross site scripting

LabRedesCefetRJ WeGIA Cadastro de Atendio Cadastro_Atendido.php cross site scripting

LabRedesCefetRJ WeGIA Additional Categoria adicionar_categoria.php cross site scripting

Affected Vendor

LabRedesCefetRJ

View all reports →

Affected Software

WeGIA

Vulnerable Versions:

< 3.4.5

Timeline

Official Publish: July 16th, 2025

Last Modified: July 18th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement