CVE-2025-22132

Description

WeGIA is a web manager for charitable institutions. A Cross-Site Scripting (XSS) vulnerability was identified in the file upload functionality of the WeGIA/html/socio/sistema/controller/controla_xlsx.php endpoint. By uploading a file containing malicious JavaScript code, an attacker can execute arbitrary scripts in the context of a victim's browser. This can lead to information theft, session hijacking, and other forms of client-side exploitation. This vulnerability is fixed in 3.2.7.

Reserved 2024-12-30 | Published 2025-01-07 | Updated 2025-01-08 | Assigner GitHub_M

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-434: Unrestricted Upload of File with Dangerous Type

Product status

< 3.2.7
affected

References

github.com/.../WeGIA/security/advisories/GHSA-h8hr-jhcx-fcv9

github.com/...ommit/330f641db43cfb0c8ea8bb6025cc0732de4d4d6b

cve.org (CVE-2025-22132)

nvd.nist.gov (CVE-2025-22132)

Download JSON