CVE-2025-57763

Cross-Site Scripting (XSS) Reflected in 'insere_despacho.php' parameter 'sccs'

CVSS 6.4 MEDIUMEPSS 0.2%CWE-79

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 6.4EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

21 Aug 2025Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the insere_despacho.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the cpf sccs. This vulnerability is fixed in 3.4.7.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H

Affected products

LabRedesCefetRJ · WeGIA

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-67w3-jf96-f754