CVE-2025-55170 - CVE House

Back to Database

Status published Medium CVE-2025-55170

WeGIA reflected XSS via `verificacao` and `redir_config` param at endpoint `/html/alterar_senha.php`

6.5 CVSS

Vulnerability Description

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a reflected cross-site scripting (XSS) vulnerability was identified in the /html/alterar_senha.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the verificacao and redir_config parameter. This issue has been patched in version 3.4.8.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-55170

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from LabRedesCefetRJ

View All →

LabRedesCefetRJ WeGIA Cadastro de Funcionário cadastro_funcionario.php cross site scripting

LabRedesCefetRJ WeGIA Adicionar tipo adicionar_tipoSaida.php cross site scripting

LabRedesCefetRJ WeGIA Adicionar tipo adicionar_tipoEntrada.php cross site scripting

LabRedesCefetRJ WeGIA Cadastro de Atendio Cadastro_Atendido.php cross site scripting

LabRedesCefetRJ WeGIA Additional Categoria adicionar_categoria.php cross site scripting

Affected Vendor

LabRedesCefetRJ

View all reports →

Affected Software

WeGIA

Vulnerable Versions:

< 3.4.8

Timeline

Official Publish: August 12th, 2025

Last Modified: August 12th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement