CVE-2025-67496

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Versions 3.5.4 and below contain a Stored Cross-Site Scripting (XSS) vulnerability in the /WeGIA/html/geral/configurar_senhas.php endpoint. The application does not sanitize user-controlled data before rendering it inside the employee selection dropdown. The application retrieves employee names from the database and injects them directly into HTML <option> elements without proper escaping. This issue is fixed in version 3.5.5.

• CWE-79

• https://github.com/LabRedesCefetRJ/WeGIA/commit/c80b8cacd310fd459df61c030fb267c5e68cafc7Patch
• https://github.com/LabRedesCefetRJ/WeGIA/releases/tag/3.5.5Release Notes
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-9843-qm67-73h2Exploit, Vendor Advisory
• https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-9843-qm67-73h2Exploit, Vendor Advisory

Published

Dec 9, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-67490The Auth0 Next.js SDK is a library for implementing user aut…5.4
• CVE-2025-67491OpenEMR is a free and open source electronic health records …5.4
• CVE-2025-67492Weblate is a web based localization tool. In versions prior …5.3
• CVE-2025-67493Homarr is an open-source dashboard. Prior to version 1.45.3,…9
• CVE-2025-67494ZITADEL is an open-source identity infrastructure tool. Vers…8.6
• CVE-2025-67495ZITADEL is an open-source identity infrastructure tool. Vers…6.1
• CVE-2025-67497Rejected reason: Further research determined the issue is no…
• CVE-2025-67498Rejected reason: Further research determined the issue is no…
• CVE-2025-67499The CNI portmap plugin allows containers to emulate opening …3.6
• CVE-2025-6750A vulnerability, which was classified as problematic, has be…3.3
• CVE-2025-67500Mastodon is a free, open-source social network server based …3.7
• CVE-2025-67501WeGIA is an open source Web Manager for Institutions with a …8.8