WeGIA, a web manager for charitable institutions, had a stored cross‑site scripting flaw in the adopters information page before version 3.6.2. The application failed to sanitize input from the "nome" parameter, allowing malicious JavaScript to be stored and automatically executed in the browsers of any user who views the page. This can lead to cookie theft, session hijacking or defacement, and is rated CVSS 5.3 for moderate impact.

The flaw affects the WeGIA application from LabRedesCefetRJ, specifically all releases prior to 3.6.2. Users running those versions and who have access to the adopters information endpoint are vulnerable.

The CVSS score of 5.3 indicates moderate risk, while the EPSS score of less than 1% suggests a very low current exploitation probability and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by submitting malicious content into the "nome" field via the cadastro_adotante.php endpoint, which is then persisted in the database. Once stored, any user who visits the adopters information page will have the payload executed, making the attack vector HTTP and requiring write privileges to the adopters data.