A stored cross‑site scripting flaw exists in projeto‑siga Siga version 11.0.3.18. By submitting a malicious payload in the Nome/Descrição field of the /sigawf/app/responsavel/novo endpoint, an attacker can cause arbitrary script execution in the browser of any user who later views that stored content. This flaw leads to potential session hijacking, defacement, and data theft because the injected script runs with the privileges of the victim's browser session.

The affected product is projeto‑siga Siga. The vulnerability has been identified specifically in version 11.0.3.18 of the application.

The CVSS score of 5.1 indicates a moderate risk, while the EPSS score of less than 1 % reflects a relatively low likelihood of exploitation at this time. The flaw is exploitable remotely via the web interface and does not require privileged access; an attacker merely needs to submit a crafted Nome/Descrição value. The vulnerability is not listed in the CISA KEV catalog, but the public disclosure of an active exploit means that exploitation is feasible if the flaw remains unpatched.