CVE-2025-30363: Wegia Wegia Stored XSS Vulnerability

CVE-2025-30363 Overview

CVE-2025-30363 is a stored Cross-Site Scripting (XSS) vulnerability in WeGIA, a web-based manager used by charitable institutions to handle administrative operations. The flaw affects all versions prior to 3.2.6 and is tracked under [CWE-79]. An attacker can inject malicious JavaScript that is persisted on the server and executed in the browser context of every user who loads the compromised page. Because the payload is stored, exploitation does not require repeated user interaction and can affect all authenticated users of the platform. The maintainers addressed the issue in version 3.2.6.

Critical Impact
Persistent script injection enables session theft, credential harvesting, and unauthorized actions performed in the context of any user viewing an affected page.

Affected Products

WeGIA versions prior to 3.2.6
Vendor: LabRedesCefetRJ (wegia)
Component: wegia:wegia

Discovery Timeline

2025-03-27 - CVE-2025-30363 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30363

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the WeGIA web application. User-supplied input is accepted and persisted to the backend without proper output encoding or sanitization. When any user later renders a page containing that stored data, the browser interprets the attacker-controlled content as executable script. Stored XSS is more severe than reflected variants because the payload persists across sessions and impacts all viewers of the affected page. The WeGIA maintainers published a GitHub Security Advisory documenting the issue and shipped a fix in version 3.2.6. See the GitHub Security Advisory (GHSA-qhfm-2qfp-h4m3) for vendor details.

Root Cause

The underlying cause is improper neutralization of input during web page generation [CWE-79]. WeGIA fails to encode or sanitize input before storing it and rendering it back to the browser. HTML control characters and script tags are preserved verbatim, allowing arbitrary JavaScript to execute in the DOM.

Attack Vector

An attacker submits a crafted payload through an affected input field that the application persists to storage. The payload requires no authentication to inject in scenarios where the vulnerable input is exposed to unauthenticated users. When a legitimate user opens the page displaying the stored value, the injected script runs with that user's privileges. Impact includes session cookie theft, credential capture, forced browser actions, and pivoting to administrative functions when a privileged user is targeted.

No public proof-of-concept exploit code was referenced in the advisory. Refer to the vendor advisory for reproduction context.

Detection Methods for CVE-2025-30363

Indicators of Compromise

Stored records in WeGIA containing HTML tags such as <script>, <img onerror=...>, or javascript: URIs in fields intended for plain text.
Outbound HTTP requests from user browsers to unknown domains shortly after loading WeGIA pages.
Unexpected session activity or account changes correlated with users who accessed pages containing attacker-controlled content.

Detection Strategies

Inventory WeGIA deployments and confirm the running version. Any version below 3.2.6 is vulnerable.
Audit database fields exposed on rendered pages for HTML or JavaScript syntax that should not be present.
Review web server access logs for POST requests containing script payloads submitted to WeGIA form endpoints.

Monitoring Recommendations

Enable web application firewall (WAF) rules that alert on XSS payload patterns targeting WeGIA URLs.
Monitor Content Security Policy (CSP) violation reports from user browsers accessing WeGIA.
Correlate authentication anomalies with page-view telemetry to identify users whose sessions may have been hijacked.

How to Mitigate CVE-2025-30363

Immediate Actions Required

Upgrade all WeGIA instances to version 3.2.6 or later without delay.
Review stored records for injected HTML or JavaScript and purge any malicious content.
Force password resets and session invalidation for users who may have accessed compromised pages.

Patch Information

WeGIA version 3.2.6 remediates CVE-2025-30363. The fix is documented in the vendor advisory GHSA-qhfm-2qfp-h4m3. Apply the upgrade following the project's standard deployment procedure and verify the version string post-upgrade.

Workarounds

Restrict access to WeGIA input endpoints to trusted users until the patch is applied.
Deploy a WAF rule to block HTML tags and script syntax in form submissions to WeGIA.
Enforce a strict Content Security Policy that disallows inline scripts to reduce exploitation impact.

bash

# Example strict CSP header for WeGIA reverse proxy
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'" always;