GitHub Advisoryadvisory · Packagist
GHSA-xgr2-5837-hf48 NovoSGA: Manipulation of User Creation Page can lead to weak password requirements
LOW
Official page ↗
- Aliases
- CVE-2025-11322
- Ecosystem
- Packagist
- Packages
- novosga/novosga
- Severity
- Low
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-521
- Reviewed
- 2025-10-07
Affected packages
• Packagist novosga/novosga: <= 2.2.12 (no fix yet)
Description
A flaw has been found in Mangati NovoSGA up to 2.2.12. The impacted element is an unknown function of the file /novosga.users/new of the component User Creation Page. Executing manipulation of the argument Senha/Confirmação da senha can lead to weak password requirements. The attack can be launched remotely. Attacks of this nature are highly complex. The exploitability is regarded as difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Related
Alias · CVE (1)
- CVE-2025-11322 A flaw has been found in Mangati NovoSGA up to 2.2.12. vulnerability
Weakness · CWE (1)
- CWE-521 Weak Password Requirements weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-11322 advisory
- https://github.com/marcelomulder/CVE/blob/main/NovoSga/CVE-2025-11322.md web
- https://github.com/marcelomulder/CVE/blob/main/NovoSga/Weak%20Password%20Policy%20in%20Novosga.md web
- https://github.com/novosga/novosga package
- https://vuldb.com/?ctiid.327203 web
- https://vuldb.com/?id.327203 web
- https://vuldb.com/?submit.664517 web