CVE-2025-6695 is a cross-site scripting (XSS) vulnerability affecting WeGIA versions 3.4.0 through 3.4.0. This flaw allows an attacker to inject malicious scripts into the application, potentially compromising user sessions and data. The vulnerability resides in the processing of the 'Insira a nova categoria' argument within the /html/matPat/adicionar_categoria.php file. A patch is available in version 3.4.1.
Successful exploitation of CVE-2025-6695 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to various malicious outcomes, including session hijacking, credential theft, and defacement of the WeGIA interface. The attacker could potentially steal sensitive information entered by users, redirect them to malicious websites, or even gain control of the application server if the user has sufficient privileges. Given the remote accessibility of the vulnerability, the blast radius extends to all users interacting with the affected WeGIA instance.
CVE-2025-6695 has been publicly disclosed, increasing the likelihood of exploitation. While the CVSS score is LOW, the ease of exploitation and potential impact warrant attention. No known active campaigns targeting this vulnerability have been reported as of the publication date. The vulnerability is not currently listed on the CISA KEV catalog.
Exploit Status
EPSS
0.07% (23% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-6695 is to upgrade WeGIA to version 3.4.1 or later, which contains the fix. If immediate upgrading is not possible, consider implementing input validation and sanitization on the 'Insira a nova categoria' argument to prevent malicious code injection. Web application firewalls (WAFs) configured to detect and block XSS attacks can provide an additional layer of defense. Regularly review and update your WAF rules to ensure they are effective against emerging threats. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple XSS payload into the 'Insira a nova categoria' field and verifying that it is properly sanitized.
Update to a patched version or implement input sanitization measures in the adicionar_categoria.php file to prevent XSS code execution. Validate and escape user input in the 'Insira a nova categoria' parameter before displaying it on the page.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-6695 is a cross-site scripting (XSS) vulnerability in WeGIA versions 3.4.0–3.4.0, allowing attackers to inject malicious scripts.
Yes, if you are using WeGIA version 3.4.0, you are affected by this vulnerability.
Upgrade WeGIA to version 3.4.1 or later to resolve the vulnerability. Input validation is a temporary workaround.
While no active campaigns are confirmed, the vulnerability is publicly disclosed and could be exploited.
Contact LabRedesCefetRJ directly, as they have not responded to early disclosure attempts.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.