The WeGIA application versions before 3.7.0 contain a reflected XSS vulnerability (CWE-79) in the lista_arquivos_etapa.php script. The id_processo parameter is embedded directly into the HTML output without proper neutralization, enabling attackers to inject and execute arbitrary JavaScript code when a victim accesses a crafted URL. This vulnerability has a CVSS 3.1 base score of 6.1, indicating medium severity, with network attack vector, low attack complexity, no privileges required, and user interaction required. The vulnerability is resolved in version 3.7.0 of WeGIA.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to session hijacking, theft of credentials, or unauthorized actions performed on behalf of the victim. There is no indication of availability impact. No known exploits in the wild have been reported.

Upgrade WeGIA to version 3.7.0 or later, where this vulnerability is fixed. Since the vendor has released a fixed version, applying this official update is the recommended remediation. Patch status is not explicitly stated but the fix is included in version 3.7.0. No additional vendor advisory content is provided.