A stored Cross‑Site Scripting flaw was discovered in the Member Registration function of WeGIA. By entering a malicious script into the Member Name field, the payload is permanently saved to the database and subsequently executed whenever a user visits certain URLs. Consequently, an attacker that can insert such a payload can run arbitrary JavaScript code in the context of other users’ browsers, potentially leading to session hijacking, credential theft, or the execution of malicious actions on behalf of those users.

The vulnerability affects the WeGIA web manager produced by LabRedesCefetRJ. Versions earlier than 3.6.10 are impacted; version 3.6.10 and later contain the fix.

The CVSS score of 7.5 indicates high severity, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the ability to submit data to the Member Registration form, after which the script is stored and later rendered to other users visiting affected pages—an attack vector that does not necessitate additional privileges beyond registering a member or at least having write access to that form.