CVE-2025-30366

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

WeGIA is a Web manager for charitable institutions. Versions prior to 3.2.8 are vulnerable to stored cross-site scripting. This vulnerability allows unauthorized scripts to be executed within the user's browser context. Stored XSS is particularly critical, as the malicious code is permanently stored on the server and executed whenever a compromised page is loaded, affecting all users accessing this page. Version 3.2.8 fixes the issue.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 27, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-303679.8WeGIA is a Web manager for charitable institutions. A SQL Injection vulnerability was identified in versions prior to 3.2.6 in the nextPage CVE-2025-303682.7Zulip is an open-source team collaboration tool. The API for deleting an organization export is supposed to be restricted to organization ad CVE-2025-303692.7Zulip is an open-source team collaboration tool. The API for deleting an organization custom profile field is supposed to be restricted to o CVE-2025-30374.3A vulnerability has been found in yzk2356911358 StudentServlet-JSP cc0cdce25fbe43b6c58b60a77a2c85f52d2102f5/d4d7a0643f1dae908a4831206f2714b2 CVE-2025-303707.4jupyterlab-git is a JupyterLab extension for version control using Git. On many platforms, a third party can create a Git repository under a CVE-2025-303712.1Metabase is a business intelligence and embedded analytics tool. Versions prior to v0.52.16.4, v1.52.16.4, v0.53.8, and v1.53.8 are vulnerab CVE-2025-303729.8Emlog is an open source website building system. Emlog Pro versions pro-2.5.7 and pro-2.5.8 contain an SQL injection vulnerability. `search_CVE-2025-303735.3Graylog is a free and open log management platform. Starting with 6.1, HTTP Inputs can be configured to check if a specified header is prese CVE-2025-303757.8Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code loca CVE-2025-303767.8Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2025-303777.8Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2025-303787.0Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code locally.