A reflected Cross‑Site Scripting (XSS) vulnerability exists in the WeGIA web manager, specifically in the file lista_arquivos_etapa.php. Because the id_processo parameter is inserted into the HTML without any sanitization, an attacker can inject malicious JavaScript. If a victim clicks a crafted link or visits a maliciously crafted page, the attacker can execute arbitrary script in the victim’s browser, potentially hijacking the session, stealing credentials, or performing malicious actions on the victim’s behalf.

The flaw affects the WeGIA product from LabRedesCefetRJ. All releases older than version 3.7.0 are vulnerable; the issue is fixed in 3.7.0 and later.

With a CVSS score of 6.1, the vulnerability is considered moderate severity. The EPSS score is not available, and it is not listed in CISA’s KEV catalog, suggesting that mass exploitation is not yet widespread. The likely attack vector involves remotely reachable web pages; an attacker can embed a malicious link that references the vulnerable id_processo parameter, triggering the XSS when an authenticated user views the page. Successful exploitation would give the attacker the same privileges as the victim’s browser session.