A Stored Cross‑Site Scripting flaw exists in the WeGIA web manager, specifically in the Processo de Aceitação page (html/atendido/processo_aceitacao.php). An authenticated user can inject malicious JavaScript that is stored on the server and executed whenever the affected page is loaded, allowing the attacker to hijack user sessions and take over accounts. The weakness is a classic input‑validation flaw (CWE‑79).

The vendor is LabRedesCefetRJ, product WeGIA. All releases prior to version 3.7.3 are affected; the patch that ends the vulnerability begins with 3.7.3 and newer releases are considered safe. No additional sub‑versions are specified in the advisory.

The CVSS score of 6.8 indicates a moderate severity. There is no EPSS score reported, and the issue is not listed in the CISA KEV catalog. Because an attacker must first authenticate within the application, the vulnerability is not remotely exploitable in the traditional sense; however, once inside the system, malicious scripts can hijack sessions and compromise other users. The likelihood of exploitation depends on the number of active authenticated users and the organization’s internal threat model.