CVE-2025-22132

WeGIA is a web manager for charitable institutions. A Cross-Site Scripting (XSS) vulnerability was identified in the file upload functionality of the WeGIA/html/socio/sistema/controller/controla_xlsx.php endpoint. By uploading a file containing malicious JavaScript code, an attacker can execute arbitrary scripts in the context of a victim's browser. This can lead to information theft, session hijacking, and other forms of client-side exploitation. This vulnerability is fixed in 3.2.7.

• CWE-79
• CWE-434

• https://github.com/nilsonLazarin/WeGIA/commit/330f641db43cfb0c8ea8bb6025cc0732de4d4d6bPatch
• https://github.com/nilsonLazarin/WeGIA/security/advisories/GHSA-h8hr-jhcx-fcv9Exploit, Vendor Advisory

Published

Jan 7, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-22127In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-22128In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2025-22129Tuleap is an Open Source Suite to improve management of soft…4.3
• CVE-2025-2213A vulnerability was found in Castlenet CBW383G2N up to 20250…4.8
• CVE-2025-22130Soft Serve is a self-hostable Git server for the command lin…8.8
• CVE-2025-22131PhpSpreadsheet is a PHP library for reading and writing spre…6.1
• CVE-2025-22133WeGIA is a web manager for charitable institutions. Prior to…9.9
• CVE-2025-22134When switching to other buffers using the :all command and v…5.5
• CVE-2025-22136Tabby (formerly Terminus) is a highly configurable terminal …8.6
• CVE-2025-22137Pingvin Share is a self-hosted file sharing platform and an …9.8
• CVE-2025-22138@codidact/qpixel is a Q&A-based community knowledge-sharing …5.1
• CVE-2025-22139WeGIA is a web manager for charitable institutions. A Reflec…6.1