Researchers identified a Reflected Cross‑Site Scripting (XSS) flaw in WeGIA’s novo_memorandoo.php module. The flaw allows an attacker to embed arbitrary JavaScript code through the sccs GET parameter without any form of filtering or encoding. When a user accepts a crafted link, the malicious script runs in the victim’s browser, potentially leading to defacement, credential theft, or session hijacking. The weakness originates from the direct concatenation of user input into an HTML alert element, corresponding to the Common Weakness Enumeration CWE‑79.

Commercially, this issue touches the LabRedesCefetRJ WeGIA web manager, specifically versions 3.6.6 and earlier. The affected component is the novo_memorandoo.php endpoint, which outputs success messages by echoing the sccs parameter into an HTML alert. All deployments of WeGIA running these versions are at risk until the patch is applied. The vulnerability is officially documented in the product’s cpe:2.3:a:wegia:wegia:*:*:*:*:*:*:*:* representation.

The CVSS rating of 9.3 classifies the flaw as Critical, and the EPSS score of less than 1 % indicates that exploitation is not yet widespread, though the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by simply having a user browse a crafted URL containing malicious sccs content; no authentication is required. If successful, the payload executes with the victim’s browser privileges, allowing attackers to steal session cookies or deface the interface.