CVE-2025-55170

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a reflected cross-site scripting (XSS) vulnerability was identified in the /html/alterar_senha.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the verificacao and redir_config parameter. This issue has been patched in version 3.4.8.

• CWE-79

• https://github.com/LabRedesCefetRJ/WeGIA/commit/c2bd4121a2b2a076c9f2ef0bdbb46231389993c8Patch
• https://github.com/LabRedesCefetRJ/WeGIA/issues/141Issue Tracking
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-77hc-c8f4-p3hcExploit, Vendor Advisory

Published

Aug 12, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-55165Autocaliweb is a web app that offers an interface for browsi…8.2
• CVE-2025-55166savg-sanitizer is a PHP SVG/XML sanitizer. Prior to version …5.1
• CVE-2025-55167WeGIA is an open source web manager with a focus on the Port…9.8
• CVE-2025-55168WeGIA is an open source web manager with a focus on the Port…9.8
• CVE-2025-55169WeGIA is an open source web manager with a focus on the Port…6.5
• CVE-2025-5517Heap-based Buffer Overflow vulnerability in ABB Terra AC wal…6.8
• CVE-2025-55171WeGIA is an open source web manager with a focus on the Port…7.5
• CVE-2025-55173Next.js is a React framework for building full-stack web app…4.3
• CVE-2025-55174In KDE Skanpage before 25.08.0, an attempt at file overwrite…3.2
• CVE-2025-55175QuickCMS is vulnerable to Reflected XSS via sLangEdit parame…6.1
• CVE-2025-55177Incomplete authorization of linked device synchronization me…5.4
• CVE-2025-55178Llama Stack prior to version v0.2.20 accepted unverified par…5.3