A stored cross‑site scripting flaw exists in the backup filename handling of the WeGIA web manager. An attacker can craft a backup file name containing malicious JavaScript payloads. When the application stores or later displays this filename, the script executes in the victim’s browser, allowing the attacker to steal session cookies, hijack user accounts, or perform actions on behalf of the authenticated user. The weakness is captured by CWE‑79.

The vulnerability affects the WeGIA system produced by LabRedesCefetRJ, specifically all versions prior to 3.6.9. The web manager is used by charitable institutions to manage their online presence, and the flaw is present in the global installation of the application, not limited to a specific module.

The CVSS base score of 8.5 classifies the issue as High severity, indicating a significant impact on confidentiality, integrity, and availability. No EPSS score is available, but the lack of a KEV listing suggests that widespread exploitation is not yet documented. The likely attack vector involves the attacker uploading a backup file with a crafted filename; the script executes when that name is rendered in an authenticated session, implying that the attacker must either have upload access or rely on social engineering to trick a user into running the backup interface. The requirement for the victim to view the stored backup file reduces immediate remote exploitation complexity but still poses a substantial risk for compromised accounts.