This vulnerability in projeto-siga siga 11.0.3.18 involves a cross-site scripting (CWE-79) flaw triggered by manipulation of the Nome/Descrição argument in a function located in /sigawf/app/responsavel/novo. The flaw allows remote attackers to inject malicious scripts that could execute in the context of the victim's browser. The CVSS 4.0 base score is 5.1 (medium), reflecting network attack vector, low attack complexity, no privileges required, but requiring user interaction and limited impact on confidentiality and integrity. No official remediation or patch has been released by the vendor as of the publication date.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of users interacting with the vulnerable function, potentially leading to session hijacking, defacement, or other client-side attacks. The impact is limited to the confidentiality and integrity of user interactions within the affected component. There are no known active exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should consider applying input validation or output encoding workarounds if possible. Monitoring for updates from the projeto-siga project is recommended to apply an official fix once available.