CVE-2025-29782

Summary

CVE-2025-29782 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the WeGIA application, which is used by charitable institutions for web management. The `adicionar_tipo_docs_atendido.php` endpoint in versions prior to 3.2.17 contains the issue. Attackers can inject malicious scripts into the `tipo` parameter, which are then stored on the server and executed automatically whenever the affected page is accessed. This poses a significant security risk as users are exposed to potential malicious code. Version 3.2.17 of the WeGIA application includes a patch to address this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.