The vulnerability is a Reflected Cross‑Site Scripting flaw (CWE‑79) where unsanitized data from the id_memorando GET parameter is echoed back into the page, allowing an attacker to inject malicious JavaScript or HTML. If executed in the victim’s browser, this can perform actions on behalf of the user, redirect them, or steal session data, effectively compromising confidentiality and integrity within the client context.

The affected product is WeGIA, a web manager for charitable institutions, developed by LabRedesCefetRJ. All releases prior to version 3.6.2 are vulnerable; 3.6.2 and later contain the fix.

The flaw carries a CVSS score of 9.1, indicating critical severity. The EPSS score is below 1 %, implying a low probability of widespread exploitation at present. It is not listed in CISA’s KEV catalog. Attacks would likely involve an unauthenticated user clicking a crafted link containing malicious payload that exploits the id_memorando parameter, resulting in code execution in the victim’s browser. While the impact is limited to the client side, it can facilitate further attacks such as session hijacking if cookies lack proper flags.