CVE-2025-57764 - WeGIA Cross-Site Scripting (XSS) Reflected endpoint 'cargos.php' parameter 'msg_e'

Back Back to CVE browser

HIGH

WeGIA Cross-Site Scripting (XSS) Reflected endpoint 'cargos.php' parameter 'msg_e'

Published Aug 21, 2025

8.2

HIGH

CVSS 3.1

EPSS 0.31%

Description

WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the cargos.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_e parameter. This vulnerability is fixed in 3.4.7.

Affected products

Vendor LabRedesCefetRJ Product WeGIA Default
n/a
- Version
  < 3.4.7
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

LabRedesCefetRJ

WeGIA

n/a

Version	Status	Constraints
< 3.4.7	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://github.com/LabRedesCefetRJ/WeGIA/commit/4e9a1c170a495eb8a8433052de19990d355cb098
x_refsource_MISCPatch
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qx7f-q867-cgx2
exploitx_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
https://github.com/LabRedesCefetRJ/WeGIA/commit/4e9a1c170a495eb8a8433052de19990d355cb098		x_refsource_MISCPatch
https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-qx7f-q867-cgx2		exploitx_refsource_CONFIRMVendor Advisory